{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-111708/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:whaticket:whaticket:*:*:*:*:community:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-111708"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WhaTicket Community (\u003c= cf04795)"],"_cs_severities":["critical"],"_cs_tags":["authentication-bypass","cve-2026-111708","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["WhaTicket"],"content_html":"\u003cp\u003eWhaTicket Community versions up to and including commit cf04795 contain a critical authentication bypass vulnerability (CVE-2026-111708). The vulnerability exists within the user registration process, specifically at the /auth/signup endpoint. An unauthenticated attacker can submit a crafted HTTP POST request to this endpoint while manipulating the 'profile' parameter. By either omitting the parameter or explicitly setting it to 'admin', the application improperly grants the newly created user administrative privileges. This provides the attacker with full control over the WhaTicket instance, including the ability to manage users, modify system settings, and access sensitive data such as customer tickets, contacts, message history, and linked WhatsApp connections. Given the critical CVSS score of 9.8, this flaw represents a significant risk for any organization hosting WhaTicket Community.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative takeover of the WhaTicket application. Attackers gain unauthorized access to all stored PII, communication histories, and integrated WhatsApp business accounts. This can lead to massive data exfiltration, the potential for further social engineering attacks leveraging the organization's WhatsApp presence, and complete disruption of customer support operations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit all user accounts within the WhaTicket environment for unauthorized administrator users created through the registration endpoint.\u003c/li\u003e\n\u003cli\u003ePatch WhaTicket Community to the latest version beyond commit cf04795; if a patch is not available, restrict access to the /auth/signup endpoint at the web application firewall (WAF) or reverse proxy layer until the environment is secured.\u003c/li\u003e\n\u003cli\u003eReview access logs for excessive POST requests to /auth/signup, particularly those originating from untrusted IP addresses, to identify potential exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T18:46:05Z","date_published":"2026-10-16T18:46:05Z","id":"https://feed.craftedsignal.io/briefs/2026-10-whaticket-auth-bypass/","summary":"WhaTicket Community through commit cf04795 is vulnerable to an authentication bypass via the /auth/signup endpoint, allowing unauthenticated attackers to self-register with administrator privileges.","title":"Authentication Bypass in WhaTicket Community","url":"https://feed.craftedsignal.io/briefs/2026-10-whaticket-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-111708","version":"https://jsonfeed.org/version/1.1"}