CVE-2026-49141
published 2026-06-08CVE-2026-49141: WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify…
PriorityP343high7.1CVSS 3.1
AVNACHPRLUINSCCLIHAN
EPSS
0.22%
12.2th percentile
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in the POST request body without tenant ownership verification. Attackers can exploit the service-role client that bypasses row-level security to modify victim contact fields including name, email, and company across tenant boundaries using only a known contact UUID.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arnasdon | wacrm | < 73041bfa6420f5e1ecbfa1dd4fa847d8529320f5 | 73041bfa6420f5e1ecbfa1dd4fa847d8529320f5 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by sup
ghsa_unreviewed·2026-06-08
CVE-2026-49141 [MEDIUM] CWE-639 WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by sup
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in the POST request body without tenant ownership verification. Attackers can exploit the service-role client that bypasses row-level security to modify victim contact fields including name, email, and company across tenant boundaries using only a known contact UUID.
VulDB
ArnasDon wacrm authorization
vuldb·2026-06-08·CVSS 7.1
CVE-2026-49141 [HIGH] ArnasDon wacrm authorization
A vulnerability was found in ArnasDon wacrm and classified as problematic. This issue affects some unknown processing. Such manipulation leads to authorization bypass.
This vulnerability is documented as CVE-2026-49141. The attack can be executed remotely. There is not any exploit available.
Applying a patch is advised to resolve this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-08
Published