CVE-2026-49141 is an authorization bypass vulnerability in ArnasDon's WACRM product before commit 73041bf. The issue arises because the automation engine does not verify tenant ownership when processing a caller-controlled contact_id in POST requests. This allows authenticated users to bypass row-level security controls by leveraging a service-role client to modify contact information of other tenants if they know the contact UUID. The vulnerability enables unauthorized access and modification of contact data across tenant boundaries.

Authenticated attackers with knowledge of a contact UUID can bypass tenant isolation controls to access and modify contact details such as name, email, and company for contacts belonging to other tenants. This breaks tenant data confidentiality and integrity within the WACRM system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided and the remediation level is unspecified, users should monitor vendor communications for updates. Until a fix is available, restrict access to authenticated users and audit usage of the automation engine to detect suspicious activity involving contact_id parameters.