CVE-2026-27158

The WhatsApp "reaction" action validated message ownership but did not enforce the same "allowFrom" JID authorization used by other outbound send paths. In "allowFrom"-restricted setups, an authenticated caller with tool access could attempt reactions to non-allowlisted chats by providing a forge...