CVE-2026-126807: WuzAPI through 1.1.0 Cross-Tenant Information Disclosure via /chat/history

Published Nov 11, 2026

Updated

WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chatjid=index to list every user's internal ID, stored chat JIDs, and last-message times.

Event History

Nov 11, 2026

CVE Published

via MITRE·08:53 PM

Data Sourced

via MITRE·08:53 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated WuzAPI user can exploit it if message history is enabled. No user interaction is required.

What information can be exposed?

The affected history endpoint can disclose chat metadata from other tenants, including users' internal IDs, stored chat JIDs, and last-message timestamps. The provided data does not indicate disclosure of message contents.

How is the vulnerable endpoint accessed?

An attacker can send a GET request to /chat/history using chat_jid=index to enumerate the exposed metadata across tenants.

Which versions are affected?

WuzAPI through version 1.1.0 is affected.

CVE-2026-126807: WuzAPI through 1.1.0 Cross-Tenant Information Disclosure via /chat/history

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

How is the vulnerable endpoint accessed?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

How is the vulnerable endpoint accessed?

Which versions are affected?