---
id: "CVE-2026-111708"
kind: "vulnerability"
aliases: ["CVE-2026-111708"]
title: "WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "whaticket-community", "fixed": [], "affected": "<= cf047955a6f0d07002ed89c67d765c28d06f8d52", "ecosystem": "github"}]
ecosystems: []
tags: ["auth-bypass", "nodejs", "other", "self-hosted", "whaticket", "whatsapp"]
not_affected_if: ["auth-required", "default-config", "managed-hosting"]
published_at: "2026-10-16T18:17:54+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111708", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:28:55+00:00"}]
---

# WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows…

WhaTicket Community (canove/whaticket-community, no release tags, master at cf04795) lets anyone who can reach POST /auth/signup create an administrator: the route has no auth, the controller passes body profile through unchecked, and the service and model default profile to admin. The default userCreation setting is enabled, so a fresh install is open. Admin gives user management, settings, all tickets, contacts, messages and linked WhatsApp sessions. The same writeup also reports a second issue: any agent can read and send on other agents' tickets by ID. No fix is published as far as I found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:whaticket-community affected <= cf047955a6f0d07002ed89c67d765c28d06f8d52 fixed ?

## How to check

Check you run WhaTicket from canove/whaticket-community at or before commit cf047955a6. Then check the Settings table or GET /settings (as admin) for userCreation: 'enabled' means open. From outside, POST /auth/signup with name, email and password and no profile; a 200 response with profile 'admin' means you are exposed (use a test email and delete the account afterwards). Review the Users table for admin accounts you did not create.

## Fix

No patched release or commit found. Mitigate now: set userCreation to disabled (PUT /settings/userCreation with value disabled, as admin), or block /auth/signup at the reverse proxy. Delete unknown admin users, rotate the settings apiToken and re-link WhatsApp sessions if you find any. Code fix is to force profile to a non-admin value on /signup and change the admin defaults in CreateUserService.ts and models/User.ts.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111708
- 2026-10-23T23:28:55+00:00 analyst — Read reporter writeup (hackmd) and source at cf04795: POST /auth/signup has no auth, profile unvalidated and defaults to admin (service and model), userCreation seeded 'enabled'. No fixed release or patch found; project has no release tags. No PoC run, no exploitation reported; X has no discussion.

## Documents

- [advisory] WhaTicket Community: unauthenticated signup creates admin (reporter writeup) https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor
- [advisory] VulnCheck advisory CVE-2026-111708 https://www.vulncheck.com/advisories/whaticket-community-through-commit-cf04795-admin-self-registration-via-auth-signup
- [describes] CreateUserService.ts at cf04795 (profile defaults to admin) https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/UserServices/CreateUserService.ts

## From the sources

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_