10 matches found
CVE-2026-111709
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...
CVE-2026-111709 WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...
CVE-2026-111709
WhaTicket Community is vulnerable to an Insecure Direct Object Reference (IDOR) (CWE-639) within commit cf04795 . The root cause is that the ShowTicketService fails to perform necessary ownership or queue checks. This allows authenticated agents to access tickets belonging to other agents by prov...
CVE-2026-111709 WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...
CVE-2026-111709
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...
CVE-2026-111709 WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...
EUVD-2026-103001
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...
CVE-2026-111709: Authorization Bypass Through User-Controlled Key
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id to GET...
PT-2026-116108
šØ CVE-2026-111709 WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another agent's ticket id ...
Cassio Santos Whaticket Open Source Authorization Issue Vulnerability
Cassio Santos: Whaticket Open Source versions from cf04795 and earlier have an authorization issue vulnerability. This vulnerability stems from insecure direct object references IDOR. ShowTicketService does not perform ownership or queue checks. Attackers can use the ticket IDs of other agents to...