CVE-2026-111709: WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET /tickets/:ticketId and /messages/:ticketId to read full message history and POST WhatsApp replies.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated agent can exploit it. The attacker needs to know or supply another agent's ticket ID; no user interaction is required.
What access does exploitation provide?
The vulnerable endpoints allow an authenticated agent to retrieve another agent's ticket and full message history through GET requests. They can also send WhatsApp replies on that ticket using the message endpoint.
Are queue or ticket ownership restrictions enforced by the affected service?
No. ShowTicketService performs no ownership or queue checks, so access is not restricted to the agent assigned to the ticket or its queue.
How can I determine whether an instance is affected?
Check whether the deployment is WhaTicket Community at or through commit cf04795. In an authorized test, an agent account that can retrieve a different agent's ticket or messages by substituting its ticket ID in /tickets/:ticketId or /messages/:ticketId indicates exposure.