CVE-2026-111708
Received Received - Intake

Authentication Bypass via Self-Registration in WhaTicket Community

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111708
EUVD
EUVD-2026-103000

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
canove whaticket-community 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in WhaTicket Community allows unauthenticated attackers to bypass authentication and self-register as administrators by sending a POST request to /auth/signup. Attackers can manipulate the profile field to gain admin privileges without proper authorization.

Detection Guidance

To detect this vulnerability, monitor for unauthenticated POST requests to /auth/signup with a profile field set to admin or omitted. Check server logs for unusual admin account creations or unauthorized access to user management and settings.

Impact Analysis

An attacker exploiting this flaw could gain full administrative access, allowing them to manage users, modify settings, and access all tickets, contacts, messages, and WhatsApp connections. This could lead to data breaches, unauthorized modifications, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately restrict access to the /auth/signup endpoint. Update WhaTicket Community to a patched version if available. Implement strict input validation for the profile field and enforce authentication for admin registration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111708. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart