The vulnerability in WACRM’s automation engine allows an authenticated attacker to bypass tenant isolation by providing an arbitrary contact_id in a POST request. Because the service‑role client ignores row‑level security, the attacker can read and modify contact fields—name, email, and company—on any tenant without ownership verification.

Affected by ArnasDon WACRM prior to commit 73041bf. Any instance that has not applied the patch corresponding to that commit remains vulnerable. The issue applies to all deployments that expose the automation‑engine endpoint to authenticated users.

The CVSS score of 5.1 indicates a moderate severity, while the lack of an EPSS score and absence from the CISA KEV catalog suggest no current known exploits but still a legitimate risk. Attack requires authentication and the knowledge of a contact UUID, but once satisfied, the attacker can make cross‑tenant modifications. The most likely attack vector is through a legitimate service‑role client that has been granted excessive privileges, leading to potential data tampering.