Threats affecting pkg:golang/wuzapi

CVE-2026-126807 is a vulnerability in asternic wuzapi versions up to 1.1.0 that allows authenticated users to bypass authorization controls and access chat metadata belonging to other tenants. This occurs through the GetHistory handler, where a crafted request can expose internal user IDs, stored chat JIDs, and last-message timestamps across tenants. The vulnerability results in cross-tenant information disclosure.