CVE-2026-77239

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-77239

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77239.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-77239

Aliases

GHSA-34q7-fv77-625j

Published

2026-09-18T16:45:27Z

Modified

2026-09-25T03:30:49Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

WACRM: Service-role routes missing a role check

Details

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, and src/app/api/flows/route.ts, a viewer can create, edit, activate, or delete flows because membership-only checks are followed by service-role writes. In src/app/api/automations/route.ts and src/app/api/automations/engine/route.ts, a viewer can create active automations and trigger outbound WhatsApp actions without the role required by the underlying write policies. This can permit unauthorized workflow changes, destructive flow deletion, and outbound actions from a role intended to be read-only. This vulnerability is fixed with commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-285"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77239.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "last_affected":  "0.7.0"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/arnasdon/wacrm

Affected ranges

Type

GIT

Repo

https://github.com/arnasdon/wacrm

Events

Introduced

Fixed

03e851bea56dcf6bb21ff1b80ba531372bf3269f

Database specific

Show details

{
    "source":  "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77239.json"