Description
WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks.
Published: 2026-11-05
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Unauthenticated disclosure of sticker media files
Action: Immediate Patch
AI Analysis

Impact

WPPConnect Server versions up to 2.10.76 contain a missing authentication check on the static /files mount. Unauthenticated attackers can request URLs such as /files/file<timestamp>.webp and receive decrypted sticker media belonging to any session. This results in confidential sticker content being exposed to anyone who can reach the server.

Affected Systems

The vulnerability affects the "wppconnect-server" product from wppconnect. All releases up to and including version 2.10.76 are impacted; no patched version is listed in the provided data.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity impact. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack can be performed remotely over HTTP by sending crafted GET requests to the /files endpoint, and it requires only network access to the server. The attacker can enumerate multiple timestamp values to retrieve stickers from any session, effectively bypassing per-session token checks.

Generated by OpenCVE AI on November 5, 2026 at 19:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a patched release of wppconnect-server that enforces authentication on the /files endpoint (any version newer than 2.10.76).
  • If an update is delayed, restrict access to the /files directory using a reverse proxy or firewall rule that requires authentication or limits traffic to trusted IP ranges.
  • Continuously monitor logs for anomalous GET requests to /files/file*.webp and consider tightening the static file serving configuration to prevent exposure of sensitive assets.

Generated by OpenCVE AI on November 5, 2026 at 19:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Description WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks.
Title WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files
Weaknesses CWE-552
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-05T18:16:35.070Z

Reserved: 2026-11-05T17:58:49.018Z

Link: CVE-2026-123197

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-05T19:17:18.187

Modified: 2026-11-05T19:17:18.187

Link: CVE-2026-123197

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T20:00:09Z

Weaknesses
  • CWE-552

    Files or Directories Accessible to External Parties