EUVD-2026-103001
GHSA-hphf-v3fg-q5vg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege agent
-
DeliveryEnumerate sequential ticket IDs
-
ExploitRequest GET /tickets/:ticketId and /messages/:ticketId
-
ExecutionShowTicketService skips ownership check
-
ImpactRead history and POST WhatsApp reply
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated agent account on the target WhaTicket Community instance (CVSS PR:L); any logged-in agent qualifies. The attacker supplies another agent's ticketId to GET /tickets/:ticketId or /messages/:ticketId, and because ShowTicketService enforces no ownership or queue membership check, access is granted. No special non-default configuration or user interaction is needed. Limiting factors: the attacker must already hold agent-level credentials, exploitation is confined to instances running at or before commit cf04795, and impact is bounded to ticket data and message-sending rather than full system compromise. |
| Impact | This is a genuine but moderate-severity authorization flaw, not a critical priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N, score 5.3) is internally consistent with the description: network-reachable, low complexity, no user interaction, but requiring an existing authenticated agent account (PR:L) and yielding only limited confidentiality and integrity impact with no availability impact. No EPSS score was supplied, so statistical exploitation probability cannot be weighed. KEV status is not present in the input, so this is NOT a known actively-exploited vulnerability. No explicit POC flag was provided, though the referenced hackmd writeup documents the exact vulnerable endpoints and technique. The signals do not conflict: a low-privilege-but-authenticated IDOR in a niche open-source product that exposes customer conversations and allows sending messages as another agent. The main real-world risk driver is multi-tenant/multi-agent deployments where any agent can impersonate colleagues; it is a real insider/cross-tenant privacy and integrity issue rather than a mass-exploitable RCE. |
| Exploit ScenarioDerived | A malicious or compromised low-privilege support agent logged into a WhaTicket Community instance enumerates or guesses numeric ticket IDs belonging to other agents and calls GET /tickets/:ticketId and /messages/:ticketId. Because ShowTicketService performs no ownership or queue check, the attacker reads the full WhatsApp message history of tickets they do not own and can POST replies that are delivered as that agent. A public technical writeup describing the exact endpoints exists, lowering the skill needed, though no weaponized exploit tool is confirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Insecure direct object reference in WhaTicket Community (all builds through commit cf04795) lets any authenticated agent read another agent's complete WhatsApp ticket history and post replies into that conversation by simply substituting a victim's ticketId in GET /tickets/:ticketId or the /messages/:ticketId endpoints. The flaw is a missing authorization check rather than a memory-safety or injection issue, so it is trivially reachable by any logged-in agent account and requires no user interaction or unusual configuration; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) is consistent with the published CVSS 4.0 score of 5.3, placing this at moderate severity rather than critical. No public exploit code was identified at time of analysis and the product does not appear in CISA KEV, although the disclosure is publicly documented in a HackMD writeup and a VulnCheck advisory, which raises the likelihood of opportunistic abuse on internet-exposed instances.
RemediationAI
No vendor-released patch was identified at time of analysis: the references point to the vulnerable commit rather than a fix, so there is no exact patched version to cite and the commit hash cf04795 should be treated as the last-confirmed-vulnerable revision. The most effective action is to apply an upstream fix or local code patch that adds an ownership/queue authorization check inside ShowTicketService so the ticket lookup is constrained to tickets assigned to the requesting agent (or their queue), and to enforce the same check in MessageController before any outbound WhatsApp message is created; this requires no schema change but must cover every controller that resolves a ticketId, otherwise the bypass simply moves to an unchecked endpoint. Until such a fix is deployed, compensating controls are: restrict agent-role provisioning so only vetted staff hold accounts (the flaw requires a valid authenticated agent, per PR:L in the assessed vector), place WhaTicket behind an authenticated reverse proxy or VPN allow-list to remove it from untrusted internet exposure (side effect: mobile/external agents lose direct access), and add server-side logging/alerting on ticketId values requested by a session that do not belong to that session's queue to catch enumeration attempts. Note that hiding or obfuscating ticket IDs is not a fix - with roughly sequential numeric IDs an attacker can still guess valid values - and that rate limiting only slows, not prevents, the read and reply abuse. If ticket message contents are business-critical, treat existing conversations as potentially exposed and review agent activity logs for unauthorized reads or injected WhatsApp replies while the authorization check is being written.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness is CWE-639 (Authorization Bypass Through User-Controlled Key), the classic IDOR pattern: a client-supplied identifier is used to fetch and act on a server-side object without verifying that the caller is entitled to that object. In WhaTicket Community's Node/TypeScript backend, ShowTicketService.ts (referenced at commit cf047955a6f0d07002ed89c67d765c28d06f8d52) loads a ticket purely by the ID supplied in the request and performs no ownership or queue-membership check, and MessageController.ts (lines 24-58 in the same commit) follows the same pattern when accepting POST requests that create outbound WhatsApp messages. Because the ticket ID is an enumerable sequential key shared across tenants/queues in a multi-agent support desk, any holder of the 'agent' role can pivot horizontally across the entire ticket corpus and inject messages into other agents' customer conversations through the integrated WhatsApp channel. The affected package is tracked as CPE cpe:2.3:a:canove:whaticket-community, i.e. the open-source canove/whaticket-community project; the enumeration-limited scope means only ticket data and the ability to send replies are exposed, not administrative takeover or host-level compromise.
Know when Whaticket Community gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Authenticated agent account needed so PR:L; network endpoint with no interaction and no special conditions gives AV:N/AC:L/UI:N; limited data read (C:L) and ability to send replies (I:L), no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB