EUVD-2026-103000
GHSA-6xw5-h4c8-ww5j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed signup endpoint
-
DeliverySend POST /auth/signup with profile=admin
-
ExploitBackend creates unrestricted admin account
-
ExecutionAuthenticate as new administrator
-
ImpactAccess all tickets, contacts, WhatsApp sessions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The application's /auth/signup registration endpoint must be network-reachable and enabled, which is the default in WhaTicket Community through commit cf04795. The flaw is that CreateUserService/UserController do not restrict or validate the user-supplied profile field, so an unauthenticated request that omits profile or sets profile=admin yields an administrator account. No authentication, no user interaction, and no non-default configuration are required. The primary limiting factor is exposure: only instances whose signup endpoint is reachable by the attacker (e.g., internet-facing or accessible on the attacker's network segment) and that run the vulnerable code (at/before cf04795) are affected; installs that disable public signup or sit behind restrictive network controls reduce the practical attack surface. |
| Impact | All available signals point to this being a genuine high-priority issue for anyone running WhaTicket Community at or before commit cf04795. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes a remote, unauthenticated, low-complexity attack requiring no user interaction and yielding full confidentiality, integrity, and availability impact - the maximal-exposure profile, consistent with the 9.3 score. The vulnerability class (CWE-269, improper privilege management) is corroborated by the linked source code in CreateUserService.ts and UserController.ts, which show the signup path accepting an attacker-controlled profile field. A detailed public technical writeup on HackMD describes the exact bypass (omitting or setting profile=admin on POST /auth/signup), substantially lowering the barrier to exploitation even though no packaged exploit tool is cataloged. Conflicting/missing signals: no EPSS score and no CISA KEV entry were provided in the input, and there is no explicit POC=YES flag, so despite the trivial attack the measured exploitation probability and confirmed in-the-wild status are UNKNOWN from this data. The low real-world deployment footprint of this open-source product is the main factor tempering what is otherwise a near-worst-case technical flaw. |
| Exploit ScenarioDerived | An attacker who can reach the application's web interface sends a single crafted POST request to /auth/signup, either omitting the profile field or explicitly setting it to admin, and is immediately provisioned an administrator account. With admin rights they log in and access or exfiltrate all tickets, contacts, messages, and connected WhatsApp sessions, and modify system settings and users. A step-by-step public writeup (HackMD) documents the reproduction, so no custom exploit development is needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Unauthenticated administrative account creation in WhaTicket Community through commit cf04795 allows remote attackers to self-register as administrators via POST /auth/signup by omitting the profile field or setting it to admin. Successful exploitation grants control over user management, settings, and all tickets, contacts, messages, and WhatsApp connections. The flaw is unauthenticated and network-reachable under the assessed CVSS:3.1 vector, but no CISA KEV active exploitation is confirmed and no public exploit is explicitly identified at time of analysis, although a public technical writeup reference exists.
RemediationAI
No vendor-released patch version is identified in the provided data, so treat this as no vendor-released patch identified at time of analysis. Until a fixed release is available, immediately disable public self-registration or restrict POST /auth/signup to trusted networks; if registration must remain open, manually patch the signup flow so the server ignores any client-supplied profile/role value and assigns only a non-privileged default, while requiring an authenticated administrator for any admin creation. Audit existing accounts for unexpected administrators and review logs for POST /auth/signup requests that omit profile or set profile=admin. Network-level controls such as blocking /auth/signup at the reverse proxy or WAF are effective but will prevent legitimate self-service onboarding, and code-level restrictions must be applied consistently to avoid breaking expected user creation. Refer to https://www.vulncheck.com/advisories/whaticket-community-through-commit-cf04795-admin-self-registration-via-auth-signup and https://hackmd.io/@hieuPenguinnn/whaticket-community-signup-eop-ticket-idor for technical details.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WhaTicket Community is an open-source WhatsApp-based ticketing/helpdesk application. The vulnerability maps to CWE-269 (Improper Privilege Management) because the signup flow in backend/src/controllers/UserController.ts (lines 29-48) and backend/src/services/UserServices/CreateUserService.ts (lines 23-65) does not constrain the user-controlled profile field. POST /auth/signup creates an account, and by omitting profile or supplying profile=admin, the server assigns administrative privileges. CPE cpe:2.3:a:canove:whaticket-community:*:*:*:*:*:*:*:* identifies the affected codebase; all builds at or before commit cf04795 are in scope. The CVSS 4.0 vector confirms AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact, matching the independent CVSS:3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no authentication, no user interaction, and no non-default configuration are required, with the main limiting factor being whether the signup endpoint is reachable.
Know when Whaticket Community gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated HTTP request (AV:N/PR:N/UI:N), trivial to perform (AC:L); admin access grants full read/modify/destroy over all app data, so C:H/I:H/A:H with S:U as impact stays within the app's authorization scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.
Executive ViewAI
WhaTicket Community deployments exposed to the internet face a critical account-takeover risk that can give attackers administrative control over customer support operations and connected WhatsApp communications. Successful abuse could expose ticket histories, contact details, messages, and integration credentials, creating privacy, regulatory, and customer-trust consequences. No CISA KEV active exploitation is confirmed and no public exploit identified at time of analysis, but no vendor-released patch identified at time of analysis, so leadership should prioritize containment of exposed instances.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to trusted IPs, VPN, or authenticated reverse proxy; disable or restrict POST /auth/signup; implement WAF rules blocking signup requests that omit the profile field or set profile=admin; audit and remove unauthorized admin accounts; monitor logs for signup and admin-account anomalies; apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB