CVE-2026-123197

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123197", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-05T17:58:49.018Z", "datePublished": "2026-11-05T18:16:35.070Z", "dateUpdated": "2026-11-09T17:45:26.816Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:16:35.070Z"}, "datePublic": "2026-11-05T00:00:00.000Z", "title": "WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files", "descriptions": [{"lang": "en", "value": "WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Files or Directories Accessible to External Parties", "cweId": "CWE-552", "type": "CWE"}]}], "affected": [{"vendor": "wppconnect", "product": "wppconnect-server", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "2.10.76", "status": "affected", "versionType": "semver"}], "packageURL": "pkg:npm/%40wppconnect/server", "repo": "https://github.com/wppconnect-team/wppconnect-server"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/wppconnect-team/wppconnect-server/issues/2708", "tags": ["issue-tracking"]}, {"url": "https://github.com/wppconnect-team/wppconnect-server/pull/2709", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/wppconnect-team/wppconnect-server/commit/bf1faac7a14892207348c3dc5f6e03ed180e09e8", "tags": ["patch"]}, {"url": "https://github.com/wppconnect-team/wppconnect-server/blob/d08285afca862e60fb82675ce73e630de6c857bf/src/index.ts#L68", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@hieund/wppconnect-files-unauth-cross-session-sticker-media-disclosure", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/wppconnect-server-through-2.10.76-unauthenticated-sticker-media-disclosure-via-files"}], "credits": [{"lang": "en", "value": "hieuPenguinnn", "type": "finder"}, {"lang": "en", "value": "joaosouz4dev", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T17:38:27.641751Z", "id": "CVE-2026-123197", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:45:26.816Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-123197", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T17:38:27.641751Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:38:28.862Z"}}], "cna": {"title": "WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files", "credits": [{"lang": "en", "type": "finder", "value": "hieuPenguinnn"}, {"lang": "en", "type": "remediation developer", "value": "joaosouz4dev"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"repo": "https://github.com/wppconnect-team/wppconnect-server", "vendor": "wppconnect", "product": "wppconnect-server", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.10.76"}], "packageURL": "pkg:npm/%40wppconnect/server", "defaultStatus": "unaffected"}], "datePublic": "2026-11-05T00:00:00.000Z", "references": [{"url": "https://github.com/wppconnect-team/wppconnect-server/issues/2708", "tags": ["issue-tracking"]}, {"url": "https://github.com/wppconnect-team/wppconnect-server/pull/2709", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/wppconnect-team/wppconnect-server/commit/bf1faac7a14892207348c3dc5f6e03ed180e09e8", "tags": ["patch"]}, {"url": "https://github.com/wppconnect-team/wppconnect-server/blob/d08285afca862e60fb82675ce73e630de6c857bf/src/index.ts#L68", "tags": ["technical-description"]}, {"url": "https://hackmd.io/@hieund/wppconnect-files-unauth-cross-session-sticker-media-disclosure", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/wppconnect-server-through-2.10.76-unauthenticated-sticker-media-disclosure-via-files", "name": "VulnCheck Advisory: WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-552", "description": "Files or Directories Accessible to External Parties"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-05T18:16:35.070Z"}}}, "cveMetadata": {"cveId": "CVE-2026-123197", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:45:26.816Z", "dateReserved": "2026-11-05T17:58:49.018Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-05T18:16:35.070Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/%40wppconnect/server", "product": "wppconnect-server", "repo": "https://github.com/wppconnect-team/wppconnect-server", "vendor": "wppconnect", "versions": [{"lessThanOrEqual": "2.10.76", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /files/file<timestamp>.webp requests to retrieve stickers from any session, bypassing per-session token checks."}], "id": "CVE-2026-123197", "lastModified": "2026-11-12T21:36:06.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123197", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T17:38:27.641751Z", "version": "2.0.3"}}]}, "published": "2026-11-05T19:17:18.187", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/wppconnect-team/wppconnect-server/blob/d08285afca862e60fb82675ce73e630de6c857bf/src/index.ts#L68"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/wppconnect-team/wppconnect-server/commit/bf1faac7a14892207348c3dc5f6e03ed180e09e8"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/wppconnect-team/wppconnect-server/issues/2708"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/wppconnect-team/wppconnect-server/pull/2709"}, {"source": "disclosure@vulncheck.com", "url": "https://hackmd.io/@hieund/wppconnect-files-unauth-cross-session-sticker-media-disclosure"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/wppconnect-server-through-2.10.76-unauthenticated-sticker-media-disclosure-via-files"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-552"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "wppconnect-server: wppconnect-server: Information disclosure via unauthenticated static file endpoints", "id": "2567716", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567716"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-552", "details": ["A flaw was found in wppconnect-server due to missing authentication on static file endpoints. An unauthenticated remote attacker can exploit this issue by enumerating timestamp-based file paths in requests to retrieve decrypted sticker media across sessions. This allows unauthorized access to sensitive media files, bypassing per-session authentication checks."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-123197", "public_date": "2026-11-05T18:16:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-123197\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-123197\nhttps://github.com/wppconnect-team/wppconnect-server/blob/d08285afca862e60fb82675ce73e630de6c857bf/src/index.ts#L68\nhttps://github.com/wppconnect-team/wppconnect-server/commit/bf1faac7a14892207348c3dc5f6e03ed180e09e8\nhttps://github.com/wppconnect-team/wppconnect-server/issues/2708\nhttps://github.com/wppconnect-team/wppconnect-server/pull/2709\nhttps://hackmd.io/@hieund/wppconnect-files-unauth-cross-session-sticker-media-disclosure\nhttps://www.vulncheck.com/advisories/wppconnect-server-through-2.10.76-unauthenticated-sticker-media-disclosure-via-files"], "statement": "This vulnerability is rated Moderate because it allows remote unauthenticated actors to access exposed static media files, but the potential harm is limited to unauthorized data exposure without enabling system modification or denial of service. WPPConnect Server is not packaged or distributed as part of any Red Hat enterprise offerings, meaning default environments do not include this service. Consequently, Red Hat products and customer deployments are not exposed to this flaw under standard operating conditions.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.10.76]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "wppconnect-server", "source": "cna", "vendor": "wppconnect"}, "product": "wppconnect-server", "vendor": "wppconnect"}], "created": "2026-11-05T20:00:09.810119+00:00", "updated": "2026-11-06T16:35:47.858610+00:00", "vendors": ["wppconnect", "wppconnect$PRODUCT$wppconnect-server"]}