In ArnasDon wacrm versions 0.7.0 and earlier, the automation send_webhook action lacks adequate SSRF protection. Authenticated users with automation privileges can submit arbitrary webhook URLs that bypass the isDeliverableUrl SSRF guard, allowing the server to make requests to internal network resources including sensitive cloud metadata endpoints. This could lead to unauthorized access to internal services. The issue is addressed by a code commit (23838a9959550e975d732ae08a44a3a2f0cc084b) that restores proper SSRF validation.

An attacker with automation privileges can exploit this SSRF vulnerability to make the server perform HTTP requests to internal or protected network addresses, potentially accessing sensitive internal resources such as cloud metadata services. This can lead to information disclosure and partial compromise of confidentiality and integrity within the affected environment. There is no indication of availability impact or known active exploitation in the wild.

A fix for this vulnerability is available and has been applied in a commit identified as 23838a9959550e975d732ae08a44a3a2f0cc084b. Users should upgrade to a version that includes this fix. Since this is a self-hosted product, administrators must apply the patch or update to a fixed version to mitigate the risk. No vendor advisory is provided, so patch status is based on the referenced commit. No additional mitigations are specified.