An authentication bypass in the WhaTicket Community backend permits an unauthenticated attacker to self‑register as an administrator by sending a POST request to /auth/signup. The vulnerability causes the user’s profile field to be set to "admin", granting full management rights over users, settings, tickets, contacts, messages, and WhatsApp connections. The flaw is a classic example of authentication bypass, classified as CWE‑269, and enables a complete takeover of the system without any prior credentials.

The affected software is Canove WhaTicket Community, specifically versions built from commit cf04795. The vulnerability exists in the backend controller/UserController.ts and the UserServices/CreateUserService.ts modules referenced in the commit. No other vendors or product names are listed as affected.

The CVSS score of 9.3 indicates a severe exploitability and potential impact. The EPSS score is not available, so the current exploitation probability cannot be quantified, but the lack of a KEV listing does not diminish the high risk posed by the flaw. Attackers can simply craft an HTTP POST request to the self‑registration endpoint with the profile set to "admin" or omitted. Based on the description, the likely attack vector is over the web interface where the request is sent, and no additional network or privilege prerequisites are mentioned.