Read the docs
TI-2026-85576 Aliases CVE-2026-123197GHSA-r9xw-h7vq-jh5r

Missing authentication exposes WPPConnect Server sticker media

Priority LOW 31CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-552.

Summary

WPPConnect Server through 2.10.76 is affected. A missing authentication check in its /files static mount lets attackers read decrypted sticker media (CWE-552). An unauthenticated remote attacker can enumerate Unix timestamps in file names to retrieve stickers from any session, bypassing per-session token checks.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks.

Why it matters now

EPSS 0.00415 36th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
wppconnectwppconnect-serverup to 2.10.76—No fix listedCNA
  • wppconnect-server Vendorwppconnect Affected up to 2.10.76 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for wppconnect-server.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123197
  2. 2026-11-05 Alias added: GHSA-r9xw-h7vq-jh5r
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat
  5. 2026-11-07 Priority changed: MEDIUM → LOW

References

Patch 2

Other 3

  • TI-2026-84363 Missing authentication in WPPConnect Server allows sending messages CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences