The vulnerability is an insecure direct object reference (CWE‑639) that allows an authenticated agent to retrieve or manipulate data owned by other agents. The ShowTicketService performs no ownership or queue checks, enabling any authenticated user to supply a different ticket identifier and access the full message history or post replies via WhatsApp. This results in a confidentiality breach where ticket and message content intended for one agent becomes available to another.

Canove Whaticket Community applications that incorporate commit cf04795 are affected. The CNA does not list specific version numbers; the flaw exists in any release that contains that commit. Operators should verify whether their deployed code base includes the commit or is newer, and consider updating to a version that implements ticket ownership checks.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers only need valid agent credentials to exploit the flaw; they may send a GET request to /tickets/:ticketId or /messages/:ticketId or a POST reply endpoint with another agent’s ticket ID. The lack of ownership checks makes the exploitation route straightforward and possible in any environment where agents have access to the application.