Quick answers
- Is CVE-2026-76173 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76173 being exploited in the wild.
- How severe is CVE-2026-76173?
- Informational severity, published 12 November 2026.
- Which products and versions are affected?
- Dolibarr WhatsApp module 1.9.
- Is there a fix for CVE-2026-76173?
- No fixed version is recorded yet. Disable the WHATSAPP_WEBHOOK_ALLOW option if the WhatsApp webhook functionality is not required, or restrict access to the `public/webhook/receiver.php` endpoint at the network or application level. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-76173 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-76173?
- Check whether you run Dolibarr WhatsApp module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Disable the WHATSAPP_WEBHOOK_ALLOW option if the WhatsApp webhook functionality is not required, or restrict access to the `public/webhook/receiver.php` endpoint at the network or application level.
Technical details
A blind SQL injection vulnerability exists in the public endpoint `public/webhook/receiver.php` where the `data.key.remoteJid` parameter from a JSON request is inserted directly into an SQL query without escaping or parameterization. An unauthenticated remote attacker can manipulate this parameter via timing-based inference attacks to extract database information or cause a denial of service, but only if the WHATSAPP_WEBHOOK_ALLOW option is enabled.
Affected products
- Dolibarr WhatsApp module 1.9
Timeline
- 2026-11-12: disclosed