Authentication Bypass in WhaTicket Community

WhaTicket Community versions up to and including commit cf04795 contain a critical authentication bypass vulnerability (CVE-2026-111708). The vulnerability exists within the user registration process, specifically at the /auth/signup endpoint. An unauthenticated attacker can submit a crafted HTTP POST request to this endpoint while manipulating the 'profile' parameter. By either omitting the parameter or explicitly setting it to 'admin', the application improperly grants the newly created user administrative privileges. This provides the attacker with full control over the WhaTicket instance, including the ability to manage users, modify system settings, and access sensitive data such as customer tickets, contacts, message history, and linked WhatsApp connections. Given the critical CVSS score of 9.8, this flaw represents a significant risk for any organization hosting WhaTicket Community.

Impact

Successful exploitation results in full administrative takeover of the WhaTicket application. Attackers gain unauthorized access to all stored PII, communication histories, and integrated WhatsApp business accounts. This can lead to massive data exfiltration, the potential for further social engineering attacks leveraging the organization's WhatsApp presence, and complete disruption of customer support operations.

Recommendation

• Immediately audit all user accounts within the WhaTicket environment for unauthorized administrator users created through the registration endpoint.
• Patch WhaTicket Community to the latest version beyond commit cf04795; if a patch is not available, restrict access to the /auth/signup endpoint at the web application firewall (WAF) or reverse proxy layer until the environment is secured.
• Review access logs for excessive POST requests to /auth/signup, particularly those originating from untrusted IP addresses, to identify potential exploitation attempts.