CVE-2026-77239: CWE-285: Improper Authorization in ArnasDon wacrm
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, and src/app/api/flows/route.ts, a viewer can create, edit, activate, or delete flows because membership-only checks are followed by service-role writes. In src/app/api/automations/route.ts and src/app/api/automations/engine/route.ts, a viewer can create active automations and trigger outbound WhatsApp actions without the role required by the underlying write policies. This can permit unauthorized workflow changes, destructive flow deletion, and outbound actions from a role intended to be read-only. This vulnerability is fixed with commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f.
AI Analysis
Technical Summary
WACRM versions 0.7.0 and earlier contain an improper authorization vulnerability (CWE-285) where account viewers can bypass role-based restrictions due to missing enforcement of the agent role before service-role database client usage. Specifically, in several API routes related to flows and automations, membership-only checks are performed but the subsequent service-role writes bypass row-level security, allowing viewers to create, edit, activate, or delete flows and automations. This leads to unauthorized workflow changes and outbound WhatsApp actions from roles intended to have read-only access. The vulnerability is addressed by a code commit identified as 03e851bea56dcf6bb21ff1b80ba531372bf3269f.
Potential Impact
Attackers with viewer-level access can escalate their privileges to perform high-impact actions such as modifying or deleting workflows and triggering outbound WhatsApp messages. This compromises the integrity and availability of the CRM workflows and automation processes. The vulnerability does not affect confidentiality but has high impact on integrity and availability.
Mitigation Recommendations
A fix is available and has been implemented in the codebase with commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f. Users should upgrade to a version that includes this commit or apply the patch to enforce proper role checks before service-role database client usage. Since this is a self-hosted product, administrators must manually update their deployments to remediate this issue.
CVE-2026-77239: CWE-285: Improper Authorization in ArnasDon wacrm
Description
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, and src/app/api/flows/route.ts, a viewer can create, edit, activate, or delete flows because membership-only checks are followed by service-role writes. In src/app/api/automations/route.ts and src/app/api/automations/engine/route.ts, a viewer can create active automations and trigger outbound WhatsApp actions without the role required by the underlying write policies. This can permit unauthorized workflow changes, destructive flow deletion, and outbound actions from a role intended to be read-only. This vulnerability is fixed with commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f.
CVSS v3.1
Score 8.1high
Affected software
ArnasDon
wacrm
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
WACRM versions 0.7.0 and earlier contain an improper authorization vulnerability (CWE-285) where account viewers can bypass role-based restrictions due to missing enforcement of the agent role before service-role database client usage. Specifically, in several API routes related to flows and automations, membership-only checks are performed but the subsequent service-role writes bypass row-level security, allowing viewers to create, edit, activate, or delete flows and automations. This leads to unauthorized workflow changes and outbound WhatsApp actions from roles intended to have read-only access. The vulnerability is addressed by a code commit identified as 03e851bea56dcf6bb21ff1b80ba531372bf3269f.
Potential Impact
Attackers with viewer-level access can escalate their privileges to perform high-impact actions such as modifying or deleting workflows and triggering outbound WhatsApp messages. This compromises the integrity and availability of the CRM workflows and automation processes. The vulnerability does not affect confidentiality but has high impact on integrity and availability.
Mitigation Recommendations
A fix is available and has been implemented in the codebase with commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f. Users should upgrade to a version that includes this commit or apply the patch to enforce proper role checks before service-role database client usage. Since this is a self-hosted product, administrators must manually update their deployments to remediate this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:02:23.415Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad6e9d55bf5e2cf5463697
Added to database: 09/18/2026, 17:02:21 UTC
Last enriched: 09/18/2026, 17:16:36 UTC
Last updated: 09/19/2026, 00:02:52 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.