What happened
OpenWA <0.23.5: the GET /api/sessions/{id}/groups/{id}/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, so a valid VIEWER key scoped to a session can retrieve an active group invite code - a transferable bearer capability letting an external account join an administered group, post/read, and retain membership after revocation. Fixed in 0.23.5.
Why it matters
An AI agent tool surface (the MCP tool set) exposing a persistent WhatsApp group credential to low-privilege VIEWER keys means an agent or API consumer at the least-privilege tier can silently add and retain the attacker in business WhatsApp groups - agent-scope-to-capability escalation on a self-hosted messaging API.
Attack vector
Valid VIEWER key calls the GroupGetInviteCode MCP tool or matching REST endpoint to retrieve a group invite code, granting membership to an unauthorized account.
Affected systems
OpenWA < 0.23.5 (WhatsApp API gateway + MCP tools)
Mitigation
Upgrade to OpenWA 0.23.5+; restrict VIEWER key issuance.