Junglewise Threat Intelligence

CVE-2026-77240: WACRM database authorization bypass in profiles and AI knowledge

CVE-2026-77240 · Severity: critical · CVSS 9.9 · Published 2026-09-18

Technologies: ArnasDon WACRM. Vendors: ArnasDon.

Executive brief

WACRM is a WhatsApp CRM template that allows businesses to manage customer relationships. The vulnerability allows authenticated users to escalate their privileges within accounts or move between tenants without authorization, and to read confidential knowledge-base content belonging to other organizations. An attacker could impersonate administrators, access or modify customer data across multiple accounts, and steal proprietary information.

Technical details

Two database-layer authorization flaws exist in Supabase migrations: (1) the profiles_update RLS policy allows authenticated users to directly modify account_role and account_id columns, enabling privilege escalation and tenant-switching; (2) the match_ai_knowledge_fts and match_ai_knowledge_semantic functions run as SECURITY DEFINER with caller-controlled p_account_id but lack is_account_member checks, allowing non-members to read other tenants' knowledge chunks. Both require authentication but no tenant membership. Patches address this via RLS triggers and changing the functions to SECURITY INVOKER mode.

Affected products

  • ArnasDon WACRM 0.7.0 and earlier

Timeline

  • 2026-09-18: disclosed: Published on NVD
  • 2026-07-08: patched: Fixed by commit e01f7ed37184f972ace8fb2da5c3e37e56a6050f

References

Related threats