Whaticket Community
Monthly
Unauthenticated administrative account creation in WhaTicket Community through commit cf04795 allows remote attackers to self-register as administrators via POST /auth/signup by omitting the profile field or setting it to admin. Successful exploitation grants control over user management, settings, and all tickets, contacts, messages, and WhatsApp connections. The flaw is unauthenticated and network-reachable under the assessed CVSS:3.1 vector, but no CISA KEV active exploitation is confirmed and no public exploit is explicitly identified at time of analysis, although a public technical writeup reference exists.
Insecure direct object reference in WhaTicket Community (all builds through commit cf04795) lets any authenticated agent read another agent's complete WhatsApp ticket history and post replies into that conversation by simply substituting a victim's ticketId in GET /tickets/:ticketId or the /messages/:ticketId endpoints. The flaw is a missing authorization check rather than a memory-safety or injection issue, so it is trivially reachable by any logged-in agent account and requires no user interaction or unusual configuration; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) is consistent with the published CVSS 4.0 score of 5.3, placing this at moderate severity rather than critical. No public exploit code was identified at time of analysis and the product does not appear in CISA KEV, although the disclosure is publicly documented in a HackMD writeup and a VulnCheck advisory, which raises the likelihood of opportunistic abuse on internet-exposed instances.
Unauthenticated administrative account creation in WhaTicket Community through commit cf04795 allows remote attackers to self-register as administrators via POST /auth/signup by omitting the profile field or setting it to admin. Successful exploitation grants control over user management, settings, and all tickets, contacts, messages, and WhatsApp connections. The flaw is unauthenticated and network-reachable under the assessed CVSS:3.1 vector, but no CISA KEV active exploitation is confirmed and no public exploit is explicitly identified at time of analysis, although a public technical writeup reference exists.
Insecure direct object reference in WhaTicket Community (all builds through commit cf04795) lets any authenticated agent read another agent's complete WhatsApp ticket history and post replies into that conversation by simply substituting a victim's ticketId in GET /tickets/:ticketId or the /messages/:ticketId endpoints. The flaw is a missing authorization check rather than a memory-safety or injection issue, so it is trivially reachable by any logged-in agent account and requires no user interaction or unusual configuration; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) is consistent with the published CVSS 4.0 score of 5.3, placing this at moderate severity rather than critical. No public exploit code was identified at time of analysis and the product does not appear in CISA KEV, although the disclosure is publicly documented in a HackMD writeup and a VulnCheck advisory, which raises the likelihood of opportunistic abuse on internet-exposed instances.