CVE-2026-67530

WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation sendwebhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the...

PT-2026-66603

Name of the Vulnerable Software and Affected Versions WACRM versions prior to 0.7.1 Description An authenticated user with automation privileges can submit an arbitrary webhook URL that the server fetches without utilizing the isDeliverableUrl SSRF guard. This allows Server-Side Request Forgery...

wacrm 安全漏洞

WACRM is a self-hosted CRM template based on WhatsApp, developed by Arnas Donauskas. The version WACRM 73041bf previously had a security vulnerability. This vulnerability stemmed from an authorization bypass issue in the automation engine, which could allow authentication attackers to access and...