Wacrm
Monthly
Server-side request forgery in WACRM 0.7.0 and earlier allows any authenticated user holding automation privileges to coerce the application server into fetching arbitrary internal URLs, including cloud instance metadata endpoints such as 169.254.169.254. The send_webhook automation action in src/lib/automations/engine.ts was missing a call to the existing isDeliverableUrl SSRF guard that already protected the webhook_endpoints delivery path, creating an inconsistent and exploitable gap. No public exploit code has been independently identified and the vulnerability is not listed in CISA KEV; however, the fix commit and GitHub security advisory are publicly available, substantially lowering the bar for any attacker who has read the diff.
Cross-tenant contact tampering in WACRM (arnasdon/wacrm) before commit 73041bf allows any authenticated tenant user to read and modify contacts owned by other tenants by passing an arbitrary contact_id to the automation engine endpoint, which invokes a Supabase service-role client that bypasses row-level security. The flaw is an IDOR/authorization bypass (CWE-639) reported by VulnCheck; no public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Server-side request forgery in WACRM 0.7.0 and earlier allows any authenticated user holding automation privileges to coerce the application server into fetching arbitrary internal URLs, including cloud instance metadata endpoints such as 169.254.169.254. The send_webhook automation action in src/lib/automations/engine.ts was missing a call to the existing isDeliverableUrl SSRF guard that already protected the webhook_endpoints delivery path, creating an inconsistent and exploitable gap. No public exploit code has been independently identified and the vulnerability is not listed in CISA KEV; however, the fix commit and GitHub security advisory are publicly available, substantially lowering the bar for any attacker who has read the diff.
Cross-tenant contact tampering in WACRM (arnasdon/wacrm) before commit 73041bf allows any authenticated tenant user to read and modify contacts owned by other tenants by passing an arbitrary contact_id to the automation engine endpoint, which invokes a Supabase service-role client that bypasses row-level security. The flaw is an IDOR/authorization bypass (CWE-639) reported by VulnCheck; no public exploit is identified at time of analysis and the issue is not listed in CISA KEV.