{"id":"CVE-2026-111708","kind":"vulnerability","aliases":["CVE-2026-111708"],"related":[],"title":"WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows…","description":"WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.","summary":"WhaTicket Community (canove/whaticket-community, no release tags, master at cf04795) lets anyone who can reach POST /auth/signup create an administrator: the route has no auth, the controller passes body profile through unchecked, and the service and model default profile to admin. The default userCreation setting is enabled, so a fresh install is open. Admin gives user management, settings, all tickets, contacts, messages and linked WhatsApp sessions. The same writeup also reports a second issue: any agent can read and send on other agents' tickets by ID. No fix is published as far as I found.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"whaticket-community","fixed":[],"affected":"<= cf047955a6f0d07002ed89c67d765c28d06f8d52","ecosystem":"github"}],"ecosystems":[],"tags":["auth-bypass","nodejs","other","self-hosted","whaticket","whatsapp"],"not_affected_if":["auth-required","default-config","managed-hosting"],"how_to_check":"Check you run WhaTicket from canove/whaticket-community at or before commit cf047955a6. Then check the Settings table or GET /settings (as admin) for userCreation: 'enabled' means open. From outside, POST /auth/signup with name, email and password and no profile; a 200 response with profile 'admin' means you are exposed (use a test email and delete the account afterwards). Review the Users table for admin accounts you did not create.","fix":"No patched release or commit found. Mitigate now: set userCreation to disabled (PUT /settings/userCreation with value disabled, as admin), or block /auth/signup at the reverse proxy. Delete unknown admin users, rotate the settings apiToken and re-link WhatsApp sessions if you find any. Code fix is to force profile to a non-admin value on /signup and change the admin defaults in CreateUserService.ts and models/User.ts.","status":"open","published_at":"2026-10-16T18:17:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:04:58+00:00","updated_at":"2026-10-23T23:28:55+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-10-23T22:04:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"WhaTicket Community, a WhatsApp ticketing web app, lets anyone who can reach POST /auth/signup create an account with administrator rights by omitting the profile field or setting it to admin. The attacker then gets user management, settings, all tickets, contacts, messages and linked WhatsApp connections.","category":"other","who_cares":["whaticket","self-hosted","whatsapp"],"confidence":0.6,"needs_auth":"no","worst_case":"unauthenticated attacker becomes admin, reads all messages and contacts","analyst_note":"Sources give only the NVD record; check the WhaTicket repository at commit cf04795 and later for a patched signup handler and a fixed release, and confirm whether the signup route is open by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000451,"input_tokens":2775,"output_tokens":347,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources give only the NVD record; check the WhaTicket repository at commit cf04795 and later for a patched signup handler and a fixed release, and confirm whether the signup route is open by default.","search":"'-111708':15A,18A '-2026':14A,17A '/auth/signup':47B,148C 'access':165C 'admin':71B,84B,159C 'administr':50B,145C 'agent':106B,113B 'allow':12A,137C 'also':100B 'anyon':42B 'attack':139C,149C 'auth':23B,55B 'auth-bypass':22B 'authent':8A,133C 'bodi':59B 'bypass':9A,24B,134C 'canove/whaticket-community':34B 'cf04795':5A,40B,130C 'commit':4A,129C 'communiti':2A,33B,127C 'community':21A 'connect':173C 'contact':91B,169C 'contain':6A,131C 'control':57B 'creat':48B 'cve':13A,16A 'default':68B,73B 'enabl':77B 'far':122B 'field':154C 'fix':118B 'found':125B 'fresh':80B 'gain':160C 'give':85B 'host':29B 'id':116B 'instal':81B 'issu':104B 'let':41B 'link':94B 'manag':87B,162C 'master':38B 'messag':92B,170C 'model':67B 'nodej':25B 'omit':151C 'open':83B 'pass':58B 'post':46B,147C 'profil':60B,69B,153C 'publish':120B 'reach':45B 'read':108B 'regist':143C 'releas':36B 'report':101B 'rout':52B 'second':103B 'self':28B,142C 'self-host':27B 'self-regist':141C 'send':110B 'servic':65B 'session':96B 'set':75B,88B,156C,163C 'tag':37B 'ticket':90B,114B,168C 'unauthent':138C 'uncheck':62B 'user':86B,161C 'usercr':74B 'via':146C 'vulner':10A,135C 'whaticket':1A,20A,30B,32B,126C 'whaticket-community':19A 'whatsapp':31B,95B,172C 'writeup':99B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111708","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111708","severity":null,"published_at":"2026-10-16T18:17:54+00:00","modified_at":"2026-10-16T20:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111708:451","url":null,"severity":null,"published_at":"2026-10-23T23:28:55+00:00","modified_at":"2026-10-23T23:28:55+00:00","first_seen_at":"2026-10-23T23:28:55+00:00","fetched_at":"2026-10-23T23:28:55+00:00","note":"Read reporter writeup (hackmd) and source at cf04795: POST /auth/signup has no auth, profile unvalidated and defaults to admin (service and model), userCreation seeded 'enabled'. No fixed release or patch found; project has no release tags. No PoC run, no exploitation reported; X has no discussion."}],"documents":[{"id":1992,"url":"https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor","title":"WhaTicket Community: unauthenticated signup creates admin (reporter writeup)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1993,"url":"https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/UserServices/CreateUserService.ts","title":"CreateUserService.ts at cf04795 (profile defaults to admin)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1994,"url":"https://www.vulncheck.com/advisories/whaticket-community-through-commit-cf04795-admin-self-registration-via-auth-signup","title":"VulnCheck advisory CVE-2026-111708","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}