Cross-Tenant Information Disclosure Vulnerability in WuzAPI by Asternic

CVE-2026-126807

What is CVE-2026-126807?

A vulnerability in WuzAPI versions up to 1.1.0 exposes a critical flaw in the GetHistory handler that enables authenticated users to access chat metadata of other tenants. Specifically, users with message history enabled can exploit this vulnerability by sending requests to GET /chat/history with a specified chat JID. This allows them to view sensitive information including the internal ID of every user, stored chat JIDs, and timestamps of the last messages, potentially leading to unauthorized access to sensitive communication data.

References