Live › vulnerability › CVE-2026-111708
Go to dashboardWhaTicket Community (canove/whaticket-community, no release tags, master at cf04795) lets anyone who can reach POST /auth/signup create an administrator: the route has no auth, the controller passes body profile through unchecked, and the service and model default profile to admin. The default userCreation setting is enabled, so a fresh install is open. Admin gives user management, settings, all tickets, contacts, messages and linked WhatsApp sessions. The same writeup also reports a second issue: any agent can read and send on other agents' tickets by ID. No fix is published as far as I found.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| whaticket-community | github | <= cf047955a6f0d07002ed89c67d765c28d06f8d52 | – |
enabled means openadmin means you are exposed (use a test email and delete the account afterwards)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
This page as .md · .json · in your agent: get_signal("CVE-2026-111708")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.