CVE-2026-111708
CriticalCVSS 9.8Summary
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
Risk Assessment
An unauthenticated attacker can gain full administrative privileges, leading to complete system compromise and data access.
Recommendation
Update WhaTicket Community to a version containing the fix or apply mitigations.
Other vulnerabilities in WhaTicket Community
Original NVD description (English source)
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS