CVE-2026-67530

MediumCVSS 6.4

Published: 30/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

WACRM 0.7.0 and earlier allows an authenticated user with automation privileges to submit an arbitrary webhook URL that the server fetches without SSRF protection, enabling requests to private, loopback, link-local, or cloud metadata addresses.

Risk Assessment

An attacker can access internal network resources, including cloud metadata endpoints (e.g., 169.254.169.254), potentially leading to sensitive data leakage or privilege escalation.

Recommendation

Apply commit 23838a9959550e975d732ae08a44a3a2f0cc084b or upgrade to a newer version of WACRM.

Other vulnerabilities in WACRM

CVE-2026-49141High
Authorization bypass vulnerability in the WACRM automation engine prior to commit 73041bf. An authenticated attacker can access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in a POST request without tenant ownership verification. The attacker can exploit a service-role client that bypasses row-level security to modify victim contact fields (name, email, company) across tenant boundaries using only a known contact UUID.

Original NVD description (English source)

WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the server fetched without the existing isDeliverableUrl SSRF guard in src/lib/webhooks/ssrf.ts, allowing requests to private, loopback, link-local, or cloud metadata addresses such as the cloud metadata endpoint at 169.254.169.254. This vulnerability is fixed with commit 23838a9959550e975d732ae08a44a3a2f0cc084b.