CVE-2026-111708: WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the application's POST /auth/signup endpoint can exploit it. No existing account, privileges, or user interaction are required.
What access does a successful attacker obtain?
An attacker can register an administrator account and gain access to user management and settings, as well as all tickets, contacts, messages, and WhatsApp connections.
What request conditions trigger the administrator registration?
The attacker can omit the profile field when submitting POST /auth/signup, or explicitly set the profile field to admin.
Are installations affected by default?
The provided information indicates the vulnerable signup endpoint permits unauthenticated self-registration as an administrator; no separate configuration prerequisite is identified.