CVE-2026-91847

The Online Scheduling and Appointment Booking System (Bookly) WordPress plugin, in versions before 28.2 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that a requester owns the specific AI booking-assistant conversation named in unauthenticat...

in chatwoot/chatwoot

💥 BUG unprivileged user can see ticket content 💥 IMPACT User does not have any inboixes but still can see ticket details in inbox . 💥 STEP TO REPRODUCE 1.First from admin account goto https://app.chatwoot.com/app/accounts/4534/settings/agents/list and add new agent user-B .\ Now dont add this...