CVE-2026-91161

Katalog CVE

CVSS 6.4 · Medium EPSS 0,18%

Kerentanan Incorrect Authorization. Skor CVSS 3.1 6.4 (Medium) menurut github.com.

Deskripsi (NVD)

OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group invite code. The invite code is a transferable WhatsApp bearer capability, so an external account can join a group administered by the session without an OpenWA credential, gain read and post access to the group, and retain membership after the VIEWER key is revoked. Affected deployments are those that issue VIEWER keys to parties who should not be able to add accounts to administered groups; OPERATOR and ADMIN access is intended. This issue is fixed in version 0.23.5.

Rincian

Terbit di NVD

24 September 2026

Terakhir diubah

5 Oktober 2026

Status NVD

Deferred

CVSS 3.1

6.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/rmyndharis/OpenWA/commit/a888a0121543426d4e1bf55f9edaed8306ae2699
• https://github.com/rmyndharis/OpenWA/commit/d66439db9653c7aa7cbfb763003c8d3cbc8f623c
• https://github.com/rmyndharis/OpenWA/pull/1572
• https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5
• https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-45fh-xj7x-vj2x