Admin self-registration in WhaTicket Community via /auth/signup
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
WhaTicket Community through commit cf04795 contains an authentication bypass that lets unauthenticated attackers self-register as administrators via POST /auth/signup. The flaw is improper privilege management (CWE-269) in account signup. An unauthenticated remote attacker gains user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections. CISA's SSVC data lists exploitation as proof of concept and the flaw as automatable.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
No affected products listed by the sources yet.
Remediation
The sources list no fixed version for WhaTicket Community.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111708
- 2026-10-16 Alias added: GHSA-6xw5-h4c8-ww5j
- 2026-10-18 CISA SSVC decision points changed
- 2026-10-18 Priority changed: MEDIUM → HIGH
References
Other 3
- https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/services/UserServices/CreateUserService.ts#L23-L65
- https://github.com/canove/whaticket-community/blob/cf047955a6f0d07002ed89c67d765c28d06f8d52/backend/src/controllers/UserController.ts#L29-L48
- https://github.com/canove/whaticket-community
More canove vulnerabilities
- TI-2026-75495 WhaTicket Community IDOR lets agents read other agents' tickets CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-111708 · CVE Program
- CVE-2026-111708 · NVD
- FIRST EPSS
- GHSA-6xw5-h4c8-ww5j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences