WhaTicket Community Auth Bypass Enables Unauthenticated Admin Registration

WhaTicket Community contains a critical authentication bypass vulnerability that allows unauthenticated attackers to register as administrators. This flaw affects all versions of the software up to commit cf04795.

What happened

According to the National Vulnerability Database, CVE-2026-111708 is rated critical with a CVSS score of 9.3. The vulnerability stems from improper access control within the application’s registration process. Attackers can exploit this by sending a POST request to the /auth/signup endpoint. By omitting the profile field or explicitly setting it to admin, they bypass standard authentication checks. This action allows them to self-register with full administrative privileges.

Why it matters

Gaining administrative access through this method grants attackers control over user management and system settings. They can access all tickets, contacts, messages, and WhatsApp connections stored in the platform. This exposure compromises the confidentiality and integrity of the entire support environment. The flaw is classified under CWE-269, indicating improper privilege management.

What to watch

• Monitor for unauthorized admin account creations.
• Review logs for POST requests to /auth/signup.
• Check for unexpected changes to user roles.
• Inspect access patterns for new administrative sessions.

Signals worth monitoring

Security teams usually detect this type of activity by reviewing authentication logs for unusual registration patterns. Look for new administrator accounts created without prior approval or verification steps. Check web server logs for POST requests to the signup endpoint that originate from unfamiliar IP addresses. Verify that all new administrative sessions have corresponding legitimate user activity. If anomalies appear, isolate the affected systems immediately to prevent lateral movement. Review access controls to ensure only authorized personnel can modify user roles.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: WhaTicket Community

• Audit existing administrator accounts for unauthorized additions.
• Restrict access to the signup endpoint using network-level controls.
• Implement strict input validation for profile fields during registration.
• Enable enhanced logging for all authentication-related events.

Step-by-step guide: Detect Lateral Movement: Log Signals, Blind Spots and Detection Logic

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-111708?

The CVSS score is 9.3, which is rated as critical severity.

Which versions of WhaTicket Community are affected?

All versions through commit cf04795 are vulnerable to this flaw.

How do attackers exploit this vulnerability?

They send a POST request to /auth/signup with an admin profile setting.