Server-Side Request Forgery Vulnerability in WACRM by Arnas Don
CVE-2026-67530

6.4MEDIUM

Key Information:

Vendor

Arnasdon

Status
Wacrm
Vendor
CVE Published:
30 July 2026

What is CVE-2026-67530?

WACRM, a self-hostable CRM template for WhatsApp, contains a vulnerability that allows an authenticated user with automation privileges to submit arbitrary webhook URLs. In versions 0.7.0 and earlier, the server can fetch these URLs due to a lack of proper validation, bypassing the isDeliverableUrl SSRF guard. This can lead to unauthorized access to private resources, including cloud metadata endpoints and other sensitive internal services.

Affected Version(s)

wacrm <= 0.7.0

References

https://github.com/ArnasDon/wacrm/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/ArnasDon/wacrm/commit/23838a9959550e97...
x_refsource_MISC

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.