CVE-2026-77240: WACRM: Database-layer authorization bypasses
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profilesupdate row-level security policy in supabase/migrations/017accountsharing.sql permits authenticated users to modify their own accountrole and accountid, allowing a viewer to self-promote or move into another tenant and then access or modify tenant resources. Separately, matchaiknowledgefts and matchaiknowledgesemantic in supabase/migrations/030aiknowledge.sql run as SECURITY DEFINER, accept a caller-controlled paccountid, and omit an isaccountmember check, allowing an authenticated non-member to read another tenant's knowledge-base chunks. This vulnerability is fixed with commit e01f7ed37184f972ace8fb2da5c3e37e56a6050f.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
supabase/migrations/017_account_sharing.sqlto a version that resolves this vulnerability.Fixed in 0.7.0Patch e01f7ed37184f972ace8fb2da5c3e37e56a6050f - Upgrade
Upgrade
supabase/migrations/030_ai_knowledge.sqlto a version that resolves this vulnerability.Patch e01f7ed37184f972ace8fb2da5c3e37e56a6050f
Event History
Frequently Asked Questions
Which users can exploit these issues?
An authenticated WACRM user can exploit them. The account does not need to be a member of the target tenant for the knowledge-base disclosure path.
What can an attacker do through the authorization bypasses?
An attacker can modify their own account_role or account_id to promote themselves or move into another tenant, then access or modify that tenant's resources. They can also read another tenant's knowledge-base chunks by calling the affected functions with a caller-controlled account ID.
Which versions are affected and what fixes the issue?
WACRM version 0.7.0 and earlier is affected. The issue is fixed by commit e01f7ed37184f972ace8fb2da5c3e37e56a6050f.