The flaw exists in the automation send_webhook action of WACRM, which lets an authenticated user with automation privileges submit any webhook URL. The server fetches this URL without invoking the SSRF guard, enabling requests to private, loopback, link‑local, or cloud metadata addresses. Attackers can leverage this to access internal services, exfiltrate data, or reach cloud‑metadata endpoints, thereby compromising confidentiality and possibly integrity. The weakness is classified as CWE‑918.

ArnasDon’s WACRM self‑hostable CRM template is affected; versions 0.7.0 and earlier are vulnerable. The fix is incorporated in commit 23838a9959550e975d732ae08a44a3a2f0cc084b and all later releases.

With a CVSS score of 6.4, the vulnerability holds moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation; it is not listed in the CISA KEV catalog. The required authentication and automation privileges limit the vector to internal attackers. Once privileged, the attacker can direct outbound requests to arbitrary IPs that the host can reach, including sensitive cloud metadata services.