CVE-2026-111709 Details

An insecure direct object reference vulnerability has been identified in WhaTicket Community, specifically in the 'ShowTicketService' component. This vulnerability allows authenticated agents to access tickets assigned to other agents without proper authorization checks. The issue arises because the 'ShowTicketService' does not verify ticket ownership or queue assignments. Exploitation involves supplying a ticket ID belonging to another agent to the 'GET /tickets/:ticketId' and 'GET /messages/:ticketId' endpoints, thereby accessing the full message history of that ticket. Additionally, agents can use the 'POST /messages/:ticketId' endpoint to send WhatsApp replies on behalf of the ticket owner.

The vulnerability can be addressed by implementing ownership and queue checks in the 'ShowTicketService' before allowing access to ticket details. Additionally, the public signup endpoint should be secured to prevent unauthorized role assignments.