Is CVE-2026-111708 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111708?

CVE-2026-111708 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-111708

Description

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.