{"id":"CVE-2026-111708","published":"2026-10-16T18:17:54.933","lastModified":"2026-10-16T20:17:22.847","description":"WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://github.com/canove/whaticket-community","tags":[]},{"url":"https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/controllers/UserController.ts#L29-L48","tags":[]},{"url":"https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/UserServices/CreateUserService.ts#L23-L65","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor","tags":[]},{"url":"https://www.vulncheck.com/advisories/whaticket-community-through-commit-cf04795-admin-self-registration-via-auth-signup","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor","tags":[]}],"exploitRefs":[{"url":"https://github.com/canove/whaticket-community","tags":[]},{"url":"https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/controllers/UserController.ts#L29-L48","tags":[]},{"url":"https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/UserServices/CreateUserService.ts#L23-L65","tags":[]}],"hasPoc":true,"ai":{"summary":"The WhaTicket Community application has an authentication bypass vulnerability that allows unauthenticated attackers to register as administrators by manipulating the signup endpoint. This flaw enables attackers to gain full administrative access including user management, ticket access, and WhatsApp integrations.","exploitability":"The vulnerability is highly exploitable with no prerequisites, requiring only a simple POST request to the /auth/signup endpoint with minimal data manipulation.","blast_radius":"If exploited, this vulnerability could allow attackers to fully compromise the application's administrative functions, potentially exposing all user data, ticket records, contacts, messages, and WhatsApp connections to unauthorized access.","remediation":"Disable or restrict access to the /auth/signup endpoint until a patch is available, or implement authentication checks for all signup requests.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","admin-access","authentication"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:47:21.966Z"}}