CVE-2026-126807

MediumCVSS 4.3/10Last modified Nov 11, 2026

Description

WuzAPI through 1.1.0 contains a cross-tenant information disclosure vulnerability in the GetHistory handler that allows authenticated users to view other tenants' chat metadata. Attackers with message history enabled can request GET /chat/history with chat_jid=index to list every user's internal ID, stored chat JIDs, and last-message times.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 11, 2026
Last modified: Nov 11, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1268084.3weDevs ERP (WP ERP) through 1.17.11 contains an incorrect authorization vulnerability that allows authenticated employees to edit their own CVE-2026-1268097.1WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other u CVE-2026-126818.9Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Google go-attestation. parseEfiSignatureList() does no CVE-2026-1268105.4WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through CVE-2026-1268115.4BookStack before 26.09.3 contains an incorrect authorization vulnerability that allows authenticated users to access other users' unpublishe CVE-2026-1268129.8blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW CVE-2026-1268136.8Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject comm CVE-2026-1268143.5blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary t CVE-2026-1268158.1Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthenticated attackers to take CVE-2026-126825.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc.CVE-2026-126835.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc.CVE-2026-1268356.5The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced