CRITICAL 9.3 NVD
CVE-2026-111708
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrat
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
References
- https://github.com/canove/whaticket-community
- https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d5
- https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d5
- https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor
- https://www.vulncheck.com/advisories/whaticket-community-through-commit-cf04795-admin-self
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-16 via NVD.
Risk Timeline
CVE Disclosed2026-10-16 · -1 days ago
Remediation Resources
vulnfeed aggregates 16467 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.