Executive brief
WACRM, an open-source customer relationship management system, contains a security flaw in its automation engine. An authorized user could exploit this to view or change contact information belonging to other organizations using the system. This could lead to unauthorized data modification or the exposure of sensitive customer details like names and email addresses across different business accounts.
Technical details
An authorization bypass vulnerability exists in the WACRM automation engine due to insufficient tenant ownership verification. The 'POST /api/automations/engine' endpoint accepts a caller-controlled 'contact_id' in the request body. Because the engine executes tasks using a high-privilege service-role client (supabaseAdmin) that bypasses Row-Level Security (RLS), an authenticated attacker can manipulate contacts across tenant boundaries. By providing a known UUID of a contact belonging to another account, an attacker can trigger automation steps to modify contact fields (name, email, company), manage tags, or exfiltrate data via webhooks. The fix, introduced in commit 73041bf, enforces tenant isolation by verifying 'contactId' ownership before execution.
Affected products
- ArnasDon WACRM prior to commit 73041bf
Timeline
- 2026-06-02: patched: Fix merged in commit 73041bf
- 2026-06-08: disclosed: CVE published and NVD record created