Executive brief
WACRM is a self-hosted WhatsApp CRM template that allows businesses to manage customer interactions and workflows. Viewer-level accounts can bypass authorization checks to create, edit, delete flows, and trigger outbound WhatsApp actions—capabilities that should be restricted to agents only. This permits unauthorized workflow changes, workflow deletion, and sending messages that should only be available to higher-privileged users.
Technical details
The vulnerability occurs in multiple API routes (flows/[id], flows/[id]/activate, flows, automations, automations/engine) where membership checks are performed with row-level security (RLS) enabled, but write operations use a service-role database client that bypasses RLS. This allows viewers with read-only intent to escalate privileges and perform agent-level write operations. The fix adds requireRole('agent') authorization gates to all write handlers.
Affected products
- Arnas Donauskas WACRM 0.7.0 and earlier
Timeline
- 2026-09-18: disclosed: Vulnerability publicly disclosed via CVE-2026-77239
- 2026-07-08: patched: Fix merged via commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f