CVE-2026-111708: Improper Privilege Management in canove whaticket-community

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability (CVE-2026-111708) that permits unauthenticated attackers to self-register as administrators via the POST /auth/signup endpoint. The vulnerability arises because attackers can omit the profile field or explicitly set it to 'admin', thereby bypassing normal privilege checks. This grants them administrative capabilities such as managing users, changing settings, and accessing all sensitive data including tickets, contacts, messages, and WhatsApp connections. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity.

Successful exploitation allows unauthenticated attackers to gain full administrative access to the WhaTicket Community application. This includes control over user accounts, application settings, and access to all tickets, contacts, messages, and WhatsApp integration data, potentially leading to complete compromise of the affected system and exposure of sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the signup endpoint or implement additional validation to prevent unauthorized profile escalation. Monitor for suspicious signup activity and consider disabling self-registration if feasible.