Executive brief
WACRM is a WhatsApp CRM template that allows businesses to manage customer relationships. The vulnerability allows authenticated users to escalate their privileges within accounts or move between tenants without authorization, and to read confidential knowledge-base content belonging to other organizations. An attacker could impersonate administrators, access or modify customer data across multiple accounts, and steal proprietary information.
Technical details
Two database-layer authorization flaws exist in Supabase migrations: (1) the profiles_update RLS policy allows authenticated users to directly modify account_role and account_id columns, enabling privilege escalation and tenant-switching; (2) the match_ai_knowledge_fts and match_ai_knowledge_semantic functions run as SECURITY DEFINER with caller-controlled p_account_id but lack is_account_member checks, allowing non-members to read other tenants' knowledge chunks. Both require authentication but no tenant membership. Patches address this via RLS triggers and changing the functions to SECURITY INVOKER mode.
Affected products
- ArnasDon WACRM 0.7.0 and earlier
Timeline
- 2026-09-18: disclosed: Published on NVD
- 2026-07-08: patched: Fixed by commit e01f7ed37184f972ace8fb2da5c3e37e56a6050f