WhaTicket Community: Authentication bypass allowing admin self-registration

Summary

WhaTicket Community, an open-source WhatsApp ticketing system, up to commit cf04795 contains an authentication bypass in POST /auth/signup. An unauthenticated attacker can register a new account with administrator rights by omitting the profile field or setting it to admin. The attacker would then gain access to user management, settings, all tickets, contacts, messages and linked WhatsApp connections. No login or user interaction is required, so internet-exposed instances are at highest risk.

Affected

• canove WhaTicket Community (whaticket-community), all versions through commit cf047955a6f0d07002ed89c67d765c28d06f8d52
• Affected code: backend/src/controllers/UserController.ts and backend/src/services/UserServices/CreateUserService.ts
• CVSS v4.0 9.3 (Critical) per CNA record; VulDB lists 7.3 and CWE-287 instead

Fixed in

Unknown. No fixed version or fix commit has been published, and the project has no releases.

Workaround

• Block or restrict public access to POST /auth/signup at the reverse proxy or firewall (not a vendor statement)
• Restrict admin functions, settings and WhatsApp connections to internal networks or VPN
• Change default credentials and JWT secrets from their defaults

Exploitation

• CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total
• A public write-up exists (HackMD); its content was not independently reviewed
• No reports of exploitation in the wild found; treat as unknown rather than absent

Our recommendation

• Inventory all WhaTicket Community instances and check whether the signup endpoint is reachable from the internet
• Block or restrict /auth/signup and admin functions until a fixed release is confirmed
• Audit user accounts for unexpected administrators and rotate admin credentials and tokens
• Do not deploy the community version internet-facing until a fix or maintainer statement exists
• Monitor the GitHub repository and VulnCheck for a fix

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-111708 project repository github.com
• UserController.ts at commit cf04795 github.com
• CreateUserService.ts at commit cf04795 github.com
• HackMD write-up (signup EoP and IDOR) hackmd.io
• VulnCheck advisory www.vulncheck.com
• VulDB entry CVE-2026-111708 vuldb.com
• Project issues github.com
• Project releases github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:23.