CVE-2026-111709: Authorization Bypass Through User-Controlled Key in canove whaticket-community

CVE-2026-111709 describes an authorization bypass vulnerability in WhaTicket Community (version 0) introduced through commit cf04795. The ShowTicketService lacks proper ownership and queue checks when handling ticket-related requests, allowing authenticated agents to access and interact with tickets that do not belong to them. Specifically, an attacker can provide another agent's ticket ID to retrieve message histories or post replies via WhatsApp endpoints, effectively bypassing intended access controls.

Authenticated agents can access sensitive ticket information and message histories of other agents without authorization. They can also post replies on behalf of other agents via WhatsApp integration, potentially leading to unauthorized disclosure of information and impersonation within the ticketing system. The vulnerability has a CVSS 4.0 base score of 5.3, indicating a medium severity impact with network attack vector, low attack complexity, and no user interaction required.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated agents carefully and monitor for suspicious activity involving ticket ID manipulation.