CVE-2026-91847

Bookly – The Online Scheduling and Appointment Booking System WordPress plugin prior to 28.2 suffers from an IDOR vulnerability in its AI booking-assistant conversation actions. The plugin fails to verify that the requester owns the conversation referenced in unauthenticated endpoints, allowing a...

in chatwoot/chatwoot

💥 BUG unprivileged user can see ticket content 💥 IMPACT User does not have any inboixes but still can see ticket details in inbox . 💥 STEP TO REPRODUCE 1.First from admin account goto https://app.chatwoot.com/app/accounts/4534/settings/agents/list and add new agent user-B .\ Now dont add this...