WhaTicket Community Auth Bypass Lets Attackers Claim Admin Access

The open-source helpdesk software WhaTicket Community contains a critical authentication bypass vulnerability that allows unauthenticated attackers to register themselves as administrators. This flaw, tracked as CVE-2026-111708, enables complete takeover of the application by manipulating the user registration process.

According to the National Vulnerability Database record, the issue stems from improper validation in the POST /auth/signup endpoint. Attackers can exploit this by either omitting the profile field entirely or explicitly setting it to "admin" during the sign-up request. This action grants the attacker immediate administrative privileges without needing valid credentials or prior access to the system.

Technical Details and Impact

The vulnerability is classified under CWE-269, which covers improper privilege management. The National Vulnerability Database assigns a CVSS v3.1 base score of 9.3, indicating a Critical severity level. This high score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability.

An attacker who successfully exploits this flaw gains comprehensive control over the WhaTicket instance. This includes the ability to manage all user accounts, modify system settings, and access sensitive data. Specifically, the compromised admin account provides read and write access to all support tickets, customer contact information, internal messages, and configured WhatsApp connections.

Affected Versions

The vulnerability affects WhaTicket Community software up to and including commit cf04795. The National Vulnerability Database record does not specify a release version number, identifying the affected state by this specific Git commit hash. Organizations running builds based on or prior to this commit are considered vulnerable to this authentication bypass.

No vendor statement or patch release has been confirmed in the provided source material. Users of WhaTicket Community should verify their current build against the commit identifier to determine exposure. The lack of a confirmed fix means that systems running vulnerable versions remain at risk until a secure update is available.

What should you do?

Organizations using WhaTicket Community should immediately audit their installations to determine if they are running versions prior to the fix. Administrators should restrict network access to the application, ensuring that the POST /auth/signup endpoint is not exposed to untrusted networks or the public internet. Monitoring logs for unusual registration attempts or sudden privilege escalations can help detect exploitation.

What to do and how to stay safe: WhaTicket

• Verify your WhaTicket Community installation against commit cf04795 to determine if you are running a vulnerable version.
• Restrict network access to the application, ensuring the registration endpoint is not exposed to untrusted networks.
• Monitor server logs for unauthorized registration attempts or sudden changes in user privilege levels.
• Isolate affected systems from critical data networks until a vendor-provided patch is available and deployed.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-111708?

The vulnerability has a CVSS score of 9.3, which is rated as Critical severity.

How do attackers exploit this vulnerability?

Attackers exploit it by sending a POST request to /auth/signup and omitting the profile field or setting it to admin.

What data can an attacker access?

An attacker gains access to user management, settings, all tickets, contacts, messages, and WhatsApp connections.