Arnasdon Wacrm vulnerabilities

CVE-2026-77240 [CRITICAL] CWE-639 CVE-2026-77240: WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_updat WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/migrations/017_account_sharing.sql permits authenticated users to modify their own account_role and account_id, allowing a viewer to self-promote or move into another tenant and then access or modify tenant re

CVE-2026-77239 [HIGH] CWE-285 CVE-2026-77239: WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and aut WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, and src/app/a

CVE-2026-49141 [HIGH] CWE-639 CVE-2026-49141: WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in the POST request body without tenant ownership verification. Attackers can exploit the service-role c

CVE-2026-67530 [MEDIUM] CWE-918 CVE-2026-67530: WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhoo WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the server fetched without the existing isDeliverableUrl S