Insecure Direct Object Reference in WhaTicket Community Software
CVE-2026-111709

5.3MEDIUM

Key Information:

Vendor

Canove

Status
Whaticket-community
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111709?

WhaTicket Community software contains an insecure direct object reference vulnerability due to inadequate ownership and queue checks within its ShowTicketService. Authenticated users, acting as agents, can exploit this flaw to access tickets belonging to other agents. By supplying another agent's ticket ID, attackers can retrieve message histories and potentially post replies via WhatsApp. This vulnerability poses a risk of unauthorized access to sensitive ticket information, highlighting the importance of stringent access controls in ticketing systems.

Affected Version(s)

whaticket-community 0

References

https://hackmd.io/@hieuPenguinnn/whaticket-community-sign...
third-party-advisory
https://github.com/canove/whaticket-community/blob/cf0479...
technical-description
https://github.com/canove/whaticket-community/blob/cf0479...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.