CVE-2026-49141
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Authorization bypass vulnerability in the WACRM automation engine prior to commit 73041bf. An authenticated attacker can access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in a POST request without tenant ownership verification. The attacker can exploit a service-role client that bypasses row-level security to modify victim contact fields (name, email, company) across tenant boundaries using only a known contact UUID.
Risk Assessment
High risk of tenant data isolation breach, potentially leading to leakage or modification of sensitive contact data.
Recommendation
Apply the patch from commit 73041bf or later, which introduces tenant ownership verification for the contact_id.
Other vulnerabilities in WACRM
Original NVD description (English source)
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in the POST request body without tenant ownership verification. Attackers can exploit the service-role client that bypasses row-level security to modify victim contact fields including name, email, and company across tenant boundaries using only a known contact UUID.