A missing operator role check on the API endpoint that retrieves a group’s invite code permits any viewer‑scoped key to obtain the code for a WhatsApp group administered by the session. The invite code is a bearer token that can be used by an external account to join the group and gain read or post rights. Consequently, an attacker who possesses a valid viewer key scoped to a session can add an arbitrary account to a group and retain membership after revoking the viewer key. This exposes the group to unauthorized participants and potentially sensitive communications, and the vulnerability is categorized with a CVSS score of 6.4.

The OpenWA project by rmyndharis, versions earlier than 0.23.5, is affected. Deployments that issue viewer keys to parties that should not be able to add external accounts to groups are at risk, while operator or admin access can prevent the exploitation.

The vulnerability is actionable via an authenticated GET request to /api/sessions/{sessionId}/groups/{groupId}/invite-code. An attacker needs a valid viewer key and knowledge of the session and group identifiers. The EPSS score is not available and it is not listed in CISA’s KEV catalog. The CVSS score of 6.4 indicates moderate severity. Because the endpoint is publicly accessible when a viewer key is available, the exploitation likelihood depends on how broadly viewer keys are distributed and whether they are protected. In environments where viewer keys are exposed to untrusted users, the risk of unauthorized group membership is significant.