Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

WACRM lets users change roles and view other tenants' data

CVE-2026-77240 · published 10 days ago
Summary

The WACRM CRM template for WhatsApp (versions up to 0.7.0) allows a logged‑in user to change their own role and account identifier, which can let them act as an administrator or move into another customer's space. It also lets a non‑member read private knowledge‑base entries from other customers. Update to the latest version of WACRM to apply the fix.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
arnasdon wacrm <= 0.7.0
Original advisory text
WACRM: Database-layer authorization bypasses
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/migrations/017_account_sharing.sql permits authenticated users to modify their own account_role and account_id, allowing a viewer to self-promote or move into another tenant and then access or modify tenant resources. Separately, match_ai_knowledge_fts and match_ai_knowledge_semantic in supabase/migrations/030_ai_knowledge.sql run as SECURITY DEFINER, accept a caller-controlled p_account_id, and omit an is_account_member check, allowing an authenticated non-member to read another tenant's knowledge-base chunks. This vulnerability is fixed with commit e01f7ed37184f972ace8fb2da5c3e37e56a6050f.
References
Severity
9.9 Critical
CVSS 3.1: 9.9 (MITRE)
Exploitation
EPSS <1%
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published18 Sep 2026
Updated27 Sep 2026
First seen18 Sep 2026
Sources
CVE-2026-77240 · NVD
CVE-2026-77240 · MITRE
CVE-2026-77240 · OSV
GHSA-fg5p-2qc3-jmxr · GHSA
Track software like this
Free during beta