CVE-2026-111708
9.8CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-269
Impact
Unauthenticated remote attackers can create admin accounts and take full control of the application. They only need network access to the registration endpoint to access all tickets, contacts, messages, and WhatsApp connections.
Root cause
The signup endpoint directly accepts the user profile parameter from unauthenticated requests without restricting admin role assignment.
Affected systems
WhaTicket Community through commit cf04795
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
No fixed version is currently listed; block external access to the POST /auth/signup endpoint or disable public registration at the reverse proxy until a patch is released.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
References
- https://github.com/canove/whaticket-community
- https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/controllers/UserController.ts#L29-L48
- https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/UserServices/CreateUserService.ts#L23-L65
- https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor
- https://www.vulncheck.com/advisories/whaticket-community-through-commit-cf04795-admin-self-registration-via-auth-signup
- https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor