CVE-2026-77239

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77239", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-20T19:02:23.415Z", "datePublished": "2026-09-18T16:45:27.574Z", "dateUpdated": "2026-09-18T19:56:33.123Z"}, "containers": {"cna": {"title": "WACRM: Service-role routes missing a role check", "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "lang": "en", "description": "CWE-285: Improper Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/ArnasDon/wacrm/security/advisories/GHSA-34q7-fv77-625j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ArnasDon/wacrm/security/advisories/GHSA-34q7-fv77-625j"}, {"name": "https://github.com/ArnasDon/wacrm/pull/351", "tags": ["x_refsource_MISC"], "url": "https://github.com/ArnasDon/wacrm/pull/351"}, {"name": "https://github.com/ArnasDon/wacrm/commit/03e851bea56dcf6bb21ff1b80ba531372bf3269f", "tags": ["x_refsource_MISC"], "url": "https://github.com/ArnasDon/wacrm/commit/03e851bea56dcf6bb21ff1b80ba531372bf3269f"}], "affected": [{"vendor": "ArnasDon", "product": "wacrm", "versions": [{"version": "<= 0.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-18T16:45:27.574Z"}, "descriptions": [{"lang": "en", "value": "WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, and src/app/api/flows/route.ts, a viewer can create, edit, activate, or delete flows because membership-only checks are followed by service-role writes. In src/app/api/automations/route.ts and src/app/api/automations/engine/route.ts, a viewer can create active automations and trigger outbound WhatsApp actions without the role required by the underlying write policies. This can permit unauthorized workflow changes, destructive flow deletion, and outbound actions from a role intended to be read-only. This vulnerability is fixed with commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f."}], "source": {"advisory": "GHSA-34q7-fv77-625j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-18T19:56:20.896842Z", "id": "CVE-2026-77239", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T19:56:33.123Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77239", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T19:56:20.896842Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T19:56:29.242Z"}}], "cna": {"title": "WACRM: Service-role routes missing a role check", "source": {"advisory": "GHSA-34q7-fv77-625j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "ArnasDon", "product": "wacrm", "versions": [{"status": "affected", "version": "<= 0.7.0"}]}], "references": [{"url": "https://github.com/ArnasDon/wacrm/security/advisories/GHSA-34q7-fv77-625j", "name": "https://github.com/ArnasDon/wacrm/security/advisories/GHSA-34q7-fv77-625j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ArnasDon/wacrm/pull/351", "name": "https://github.com/ArnasDon/wacrm/pull/351", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ArnasDon/wacrm/commit/03e851bea56dcf6bb21ff1b80ba531372bf3269f", "name": "https://github.com/ArnasDon/wacrm/commit/03e851bea56dcf6bb21ff1b80ba531372bf3269f", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, and src/app/api/flows/route.ts, a viewer can create, edit, activate, or delete flows because membership-only checks are followed by service-role writes. In src/app/api/automations/route.ts and src/app/api/automations/engine/route.ts, a viewer can create active automations and trigger outbound WhatsApp actions without the role required by the underlying write policies. This can permit unauthorized workflow changes, destructive flow deletion, and outbound actions from a role intended to be read-only. This vulnerability is fixed with commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285: Improper Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-18T16:45:27.574Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77239", "state": "PUBLISHED", "dateUpdated": "2026-09-18T19:56:33.123Z", "dateReserved": "2026-08-20T19:02:23.415Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-18T16:45:27.574Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "wacrm", "vendor": "ArnasDon", "versions": [{"status": "affected", "version": "<= 0.7.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. In src/app/api/flows/[id]/route.ts, src/app/api/flows/[id]/activate/route.ts, and src/app/api/flows/route.ts, a viewer can create, edit, activate, or delete flows because membership-only checks are followed by service-role writes. In src/app/api/automations/route.ts and src/app/api/automations/engine/route.ts, a viewer can create active automations and trigger outbound WhatsApp actions without the role required by the underlying write policies. This can permit unauthorized workflow changes, destructive flow deletion, and outbound actions from a role intended to be read-only. This vulnerability is fixed with commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f."}], "id": "CVE-2026-77239", "lastModified": "2026-09-23T18:12:04.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77239", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-18T19:56:20.896842Z", "version": "2.0.3"}}]}, "published": "2026-09-18T17:17:00.200", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ArnasDon/wacrm/commit/03e851bea56dcf6bb21ff1b80ba531372bf3269f"}, {"source": "security-advisories@github.com", "url": "https://github.com/ArnasDon/wacrm/pull/351"}, {"source": "security-advisories@github.com", "url": "https://github.com/ArnasDon/wacrm/security/advisories/GHSA-34q7-fv77-625j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.7.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "wacrm", "source": "cna", "vendor": "ArnasDon"}, "product": "wacrm", "vendor": "arnasdon"}], "created": "2026-09-19T14:15:17.558938+00:00", "updated": "2026-09-19T23:30:13.571883+00:00", "vendors": ["arnasdon", "arnasdon$PRODUCT$wacrm"]}