Is CVE-2026-49141 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49141 being exploited in the wild.

How severe is CVE-2026-49141?

High severity, with a CVSS score of 7.1, published 8 June 2026.

Which products and versions are affected?

ArnasDon WACRM prior to commit 73041bf.

Is there a fix for CVE-2026-49141?

A patch was published on 2026-06-02: Fix merged in commit 73041bf Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49141 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49141?

Check whether you run ArnasDon WACRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49141: WACRM authorization bypass in automation engine

CVE-2026-49141 · Severity: high · CVSS 7.1 · Published 2026-06-08

WACRM, an open-source customer relationship management system, contains a security flaw in its automation engine. An authorized user could exploit this to view or change contact information belonging to other organizations using the system. This could lead to unauthorized data modification or the exposure of sensitive customer details like names and email addresses across different business accounts.

Technologies: ArnasDon WACRM. Vendors: ArnasDon.

Quick answers

Is CVE-2026-49141 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49141 being exploited in the wild.
How severe is CVE-2026-49141?: High severity, with a CVSS score of 7.1, published 8 June 2026.
Which products and versions are affected?: ArnasDon WACRM prior to commit 73041bf.
Is there a fix for CVE-2026-49141?: A patch was published on 2026-06-02: Fix merged in commit 73041bf Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49141 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49141?: Check whether you run ArnasDon WACRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass vulnerability exists in the WACRM automation engine due to insufficient tenant ownership verification. The 'POST /api/automations/engine' endpoint accepts a caller-controlled 'contact_id' in the request body. Because the engine executes tasks using a high-privilege service-role client (supabaseAdmin) that bypasses Row-Level Security (RLS), an authenticated attacker can manipulate contacts across tenant boundaries. By providing a known UUID of a contact belonging to another account, an attacker can trigger automation steps to modify contact fields (name, email, company), manage tags, or exfiltrate data via webhooks. The fix, introduced in commit 73041bf, enforces tenant isolation by verifying 'contactId' ownership before execution.

Affected products

ArnasDon WACRM prior to commit 73041bf

Timeline

2026-06-02: patched: Fix merged in commit 73041bf
2026-06-08: disclosed: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.