CVE-2026-49141: WACRM Authorization Bypass Vulnerability

CVE-2026-49141 Overview

CVE-2026-49141 is an authorization bypass vulnerability [CWE-639] in WACRM, an open-source customer relationship management application. The flaw resides in the automation engine endpoint, which accepts a caller-controlled contact_id in the POST request body without validating tenant ownership. Authenticated attackers can read and modify contact records belonging to other tenants using only a known contact UUID.

The automation engine uses a service-role client that bypasses row-level security, amplifying the impact across tenant boundaries. The vulnerability affects WACRM commits prior to 73041bf.

Critical Impact
Authenticated tenants can modify cross-tenant contact fields including name, email, and company, breaking multi-tenant isolation guarantees.

Affected Products

WACRM (ArnasDon/wacrm) prior to commit 73041bf
Self-hosted WACRM deployments using the automation engine endpoint
Multi-tenant WACRM instances relying on row-level security for isolation

Discovery Timeline

2026-06-08 - CVE-2026-49141 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-49141

Vulnerability Analysis

The automation engine endpoint in WACRM accepts a contact_id parameter in the body of POST requests. The handler retrieves and updates the corresponding contact record without verifying that the caller's tenant owns the referenced contact. As a result, any authenticated user can target arbitrary contact UUIDs across the deployment.

The issue is compounded by the use of a service-role database client. This client is intended for privileged backend operations and intentionally bypasses Supabase row-level security policies. When the unvalidated contact_id reaches this client, tenant scoping is silently lost. Successful exploitation enables modification of victim contact attributes such as name, email, and company.

The weakness maps to [CWE-639]: Authorization Bypass Through User-Controlled Key. Exploitation requires authentication and prior knowledge of a target contact UUID, which limits trivial discovery but does not prevent enumeration through other application paths.

Root Cause

The automation engine handler trusts the client-supplied contact_id as authoritative. It performs no server-side check that the contact's tenant_id matches the authenticated session. Combined with a service-role client that skips row-level security, the missing ownership check becomes a cross-tenant data tampering primitive.

Attack Vector

An authenticated attacker submits a crafted POST request to the automation engine endpoint with a contact_id UUID belonging to another tenant. The backend updates the targeted record using the privileged service-role client. The attacker can overwrite contact fields without ever holding credentials for the victim tenant. See the VulnCheck Advisory: wacrm Bypass for additional context.

No verified exploit code is published. The fix can be reviewed in the GitHub Commit for wacrm and the corresponding GitHub Pull Request #194.

Detection Methods for CVE-2026-49141

Indicators of Compromise

POST requests to the automation engine endpoint containing contact_id values that do not belong to the authenticated session's tenant.
Unexpected modifications to contact fields such as name, email, or company without a corresponding tenant-owned audit trail.
Service-role database writes referencing contact UUIDs across multiple tenant scopes within a short window.

Detection Strategies

Instrument the automation engine handler to log the session tenant_id, the supplied contact_id, and the resolved contact's tenant_id for every request.
Alert on any request where the resolved contact tenant differs from the session tenant.
Compare contact record updated_at timestamps against authenticated session activity to identify writes lacking a legitimate caller.

Monitoring Recommendations

Forward application and database audit logs to a centralized analytics platform and retain them long enough to support retrospective hunts.
Build dashboards that track service-role client invocations by endpoint and surface anomalous volumes per tenant.
Review historical writes to the contacts table since deployment to identify potential pre-patch abuse.

How to Mitigate CVE-2026-49141

Immediate Actions Required

Upgrade WACRM to a build that includes commit 73041bf or later.
Audit contact records for unauthorized changes to name, email, and company since the automation engine was deployed.
Rotate any credentials or webhooks that may have been exposed through tampered contact fields.

Patch Information

The fix is delivered in commit 73041bf and merged via GitHub Pull Request #194. The patch adds tenant ownership validation before the automation engine performs any read or write against a contact referenced by contact_id. Self-hosted operators should pull the latest main and redeploy.

Workarounds

Disable or gate the automation engine endpoint until the patched commit is deployed.
Replace the service-role database client in the automation engine path with a tenant-scoped client that enforces row-level security.
Add a middleware check that rejects any request whose contact_id does not resolve to the authenticated tenant_id.

bash

# Update self-hosted WACRM to the patched commit
git fetch origin
git checkout 73041bfa6420f5e1ecbfa1dd4fa847d8529320f5
# Rebuild and redeploy the application
npm install
npm run build