CVE-2026-111708
waiting for further signalsZero needs more public information before it can validate it.description
WhaTicket Community through commit cf04795 is affected by an authentication bypass in its signup functionality. An unauthenticated remote attacker may create an administrator account and obtain access to application administration and WhatsApp-related data. Exploitation requires network access to the signup endpoint.
mitigation
Disable public self-registration or restrict access to the signup endpoint to trusted administrators immediately. Update to a vendor-provided release containing a verified fix when one is available.
outcome
No artifact: an exploit or check was attempted but could not be produced at this moment.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-16 17:39Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-111708
{ "etk_id": "ETK-2026-1800", "cve_id": "CVE-2026-111708", "display_id": "CVE-2026-111708", "ghsa_id": null, "euvd_id": "EUVD-2026-103000", "status": "published", "anchor_state": "anchored", "title": "Authentication bypass in WhaTicket Community signup", "summary": "WhaTicket Community through commit cf04795 is affected by an authentication bypass in its signup functionality. An unauthenticated remote attacker may create an administrator account and obtain access to application administration and WhatsApp-related data. Exploitation requires network access to the signup endpoint.", "mitigation": "Disable public self-registration or restrict access to the signup endpoint to trusted administrators immediately. Update to a vendor-provided release containing a verified fix when one is available.", "vendor": "canove", "product": "whaticket-community", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= cf047955a6f0d07002ed89c67d765c28d06f8d52" ], "ecosystem": null, "fixed_versions": [], "package_name": "whaticket-community", "purl": null } ], "cwes": [ 269 ], "cvss_score": 9.3, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "epss_score": 0.0058, "epss_percentile": 0.4656, "epss_asof": "2026-10-20", "automation": "deterministic", "check": false, "check_confidence_basis": null, "exploit": false, "pipeline_minutes": 95.67652003333333, "t0_at": "2026-10-16T17:39:59.242000+00:00", "signals": { "trigger_signal": { "at": "2026-10-16T17:39:59.242000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-16T17:39:59.242000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-111708" } } }
published 2026-10-16 18:53Z
last change 2026-10-21 05:31Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.