CVE-2026-67530

WACRM: SSRF via the automation `send_webhook` action

Published Jul 30, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Description

WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the server fetched without the existing isDeliverableUrl SSRF guard in src/lib/webhooks/ssrf.ts, allowing requests to private, loopback, link-local, or cloud metadata addresses such as the cloud metadata endpoint at 169.254.169.254. This vulnerability is fixed with commit 23838a9959550e975d732ae08a44a3a2f0cc084b.

Analysis

Technical impact

The flaw exists in the automation send_webhook action of WACRM, which lets an authenticated user with automation privileges submit any webhook URL. The server fetches this URL without invoking the SSRF guard, enabling requests to private, loopback, link‑local, or cloud metadata addresses. Attackers can leverage this to access internal services, exfiltrate data, or reach cloud‑metadata endpoints, thereby compromising confidentiality and possibly integrity. The weakness is classified as CWE‑918.

Affected Systems

ArnasDon’s WACRM self‑hostable CRM template is affected; versions 0.7.0 and earlier are vulnerable. The fix is incorporated in commit 23838a9959550e975d732ae08a44a3a2f0cc084b and all later releases.

Risk and Exploitability

With a CVSS score of 6.4, the vulnerability holds moderate severity. The EPSS score is < 1%, indicating a very low probability of exploitation; it is not listed in the CISA KEV catalog. The required authentication and automation privileges limit the vector to internal attackers. Once privileged, the attacker can direct outbound requests to arbitrary IPs that the host can reach, including sensitive cloud metadata services.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ArnasDon

wacrm

affected

Version	Status	Constraints
`<= 0.7.0`	affected	—

No data.

Vendor Product Versions

Arnasdon

Wacrm

Version	Status	Scheme	Platform
`[0,0.7.0]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade WACRM to the patched version from commit 23838a9959550e975d732ae08a44a3a2f0cc084b (or any release newer than 0.7.0).
Restrict automation privileges to trusted users and review roles that can trigger the send_webhook action.
If the webhook capability is not required, disable or remove the send_webhook automation action completely.

Generated by OpenCVE AI on August 3, 2026 at 10:30 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.260% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/ArnasDon/wacrm/commit/23838a9959550e975d732ae08a44a3a2f0cc084b
https://github.com/ArnasDon/wacrm/security/advisories/GHSA-8jqh-598v-rfxc

History

Jul 31, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 30, 2026 10:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Arnasdon Arnasdon wacrm
Vendors & Products		Arnasdon Arnasdon wacrm

Jul 30, 2026 8:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the server fetched without the existing isDeliverableUrl SSRF guard in src/lib/webhooks/ssrf.ts, allowing requests to private, loopback, link-local, or cloud metadata addresses such as the cloud metadata endpoint at 169.254.169.254. This vulnerability is fixed with commit 23838a9959550e975d732ae08a44a3a2f0cc084b.
Title		WACRM: SSRF via the automation `send_webhook` action
Weaknesses		CWE-918
References		https://github.com/ArnasDon/wacrm/commit/23838a9959550e975d732ae08a44a3a2f0cc084b https://github.com/ArnasDon/wacrm/security/advisories/GHSA-8jqh-598v-rfxc
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`