CVE-2026-111708 Details

An authentication bypass vulnerability has been identified in WhaTicket Community version through commit cf04795. This vulnerability allows unauthenticated attackers to self-register as administrators by sending a POST request to '/auth/signup'. Attackers can either omit the profile field or set it to 'admin', thereby gaining access to user management, settings, and all tickets, contacts, messages, and WhatsApp connections. The issue arises because the signup route lacks authentication middleware, the profile field is not properly validated, and the default setting allows user creation.

The vulnerability can be addressed by removing the public signup route, validating the profile field against an allow-list, and defaulting new accounts to a non-privileged role. Additionally, enforce per-agent ticket scope in the ticket management services.