rootpwn

high · CVSS v3 8.1

CVE-2026-77239

WACRM is a self-hostable CRM template for WhatsApp. In versions 0.7.0 and earlier, the application allows any authenticated viewer to create

Overview

WACRM is a self-hostable CRM template for WhatsApp. In versions 0.7.0 and earlier, the application allows any authenticated viewer to create, edit, activate, or delete flows and automations, bypassing row‑level security. This can lead to unauthorized workflow changes and outbound WhatsApp actions.

Description

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, and src/app/api/flows/route.ts, a viewer can create, edit, activate, or delete flows because membership-only checks are followed by service-role writes. In src/app/api/automations/route.ts and src/app/api/automations/engine/route.ts, a viewer can create active automations and trigger outbound WhatsApp actions without the role required by the underlying write policies. This can permit unauthorized workflow changes, destructive flow deletion, and outbound actions from a role intended to be read-only. This vulnerability is fixed with commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f.

Impact

Confidentiality: unauthorized viewers can read and modify flow definitions. Integrity: they can delete or alter flows and automations. Availability: destructive deletions may disrupt service. Defenders: administrators and security teams must ensure proper role enforcement.

Remediation

Apply the patch commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f or upgrade to WACRM 0.8.0. Verify that role checks are performed before any service‑role database writes. If upgrade is not possible, restrict viewer access to read‑only or disable flow/automation endpoints for non‑admins.

Risk context

Severity high, CVSS 8.1. No EPSS data available. Immediate attention is recommended to prevent unauthorized workflow manipulation.

Affected products

  • WACRM 0.7.0
  • WACRM 0.6
  • WACRM 0.5

Scores

Severity
high
CVSS v2
8.5
CVSS v3
8.1
CVSS v4
—
EPSS
—

WACRM WhatsApp CRM Row-level security Privilege escalation High severity Authentication bypass

← All CVEs

Related CVEs

high

CVE-2026-93455

django-page-cms through version 2.0.13 contains an authorization bypass vulnerability in its admin helper views. The flaw allows low-privilege staff accounts to read unpublished drafts, page listings, and stored media paths without proper permission validation. This matters because it exposes sensitive organizational content to internal users who should not have access.

View analysis

high

CVE-2026-52727

The lxc-ci project inadvertently included a static pacman local-signing private key within Arch Linux container and virtual machine images built prior to May 28, 2026. This allows a malicious or compromised package mirror to issue cryptographically trusted packages to clients. Consequently, attackers can achieve arbitrary code execution as root on affected systems.

View analysis

high

CVE-2026-46655

A local integer overflow vulnerability exists in the virtio-win Viosock driver for Windows guests running on QEMU and KVM. A low-privilege local user can supply specially crafted inputs via IOCTL_SELECT to cause kernel heap memory corruption. This issue matters because it enables local privilege escalation within the guest operating system.

View analysis

high

CVE-2026-55556

Rsyslog versions 8.2110.0 through 8.2604.0 contain a heap-based memory corruption vulnerability in the optional imhttp module. An unauthenticated remote attacker can trigger this flaw by sending an oversized HTTP Basic Authorization header to an affected endpoint. This causes incorrect buffer allocation and adjacent memory overwrite, resulting in a denial of service.

View analysis