Vulnerabilities

TI-2026-53925 CVE-2026-77239

WACRM: Service-role routes missing a role check

LOW 36

WACRM is a self-hostable CRM template for WhatsApp.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00525 Published 2026-09-18 No fix listed CWE-285

TI-2026-53926 CVE-2026-77240

WACRM: Database-layer authorization bypasses

HIGH 76

WACRM is a self-hostable CRM template for WhatsApp.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00506 Published 2026-09-18 No fix listed CWE-639

TI-2026-47731 CVE-2026-67530

WACRM: SSRF via the automation `send_webhook` action

LOW 28

WACRM is a self-hostable CRM template for WhatsApp.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0026 Published 2026-07-30 No fix listed CWE-918

TI-2026-36355 CVE-2026-49141 · GHSA-x2w7-xr2g-qhjr

WACRM Authorization Bypass via Automation Engine Endpoint

LOW 23

WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary…

CVSS 4.0MEDIUM 5.1 Network Low privileges No interaction EPSS 0.00216 Published 2026-06-08 Fixed CWE-639

Vulnerabilities

Filters

WACRM: Service-role routes missing a role check

WACRM: Database-layer authorization bypasses

WACRM: SSRF via the automation `send_webhook` action

WACRM Authorization Bypass via Automation Engine Endpoint