CVE-2026-67530 in WACRM
Summary
by MITRE • 07/30/2026
WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the server fetched without the existing isDeliverableUrl SSRF guard in src/lib/webhooks/ssrf.ts, allowing requests to private, loopback, link-local, or cloud metadata addresses such as the cloud metadata endpoint at 169.254.169.254. This vulnerability is fixed with commit 23838a9959550e975d732ae08a44a3a2f0cc084b.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability exists within WACRM version 0.7.0 and earlier, where the automation system lacks proper validation controls for webhook URLs submitted by authenticated users with automation privileges. The flaw is specifically located in the send_webhook action implementation within src/lib/automations/engine.ts and its corresponding validation logic in src/lib/automations/validate.ts, which fails to properly verify webhook destinations before execution. The vulnerability stems from the absence of the existing isDeliverableUrl SSRF guard that should have been protecting against requests to private network addresses, loopback interfaces, link-local addresses, and cloud metadata endpoints.
The technical implementation flaw allows an authenticated attacker with sufficient privileges to craft malicious webhook URLs that bypass the security controls designed to prevent server-side request forgery attacks. This vulnerability specifically enables access to sensitive internal network resources including private IP ranges, loopback addresses such as 127.0.0.1, link-local addresses like 169.254.x.x, and cloud metadata endpoints at 169.254.169.254 which contain critical instance metadata that could be exploited for privilege escalation or information disclosure. The absence of proper URL validation and network boundary checks creates a direct path for attackers to perform internal reconnaissance and potentially extract sensitive credentials or configuration data from cloud instances.
The operational impact of this vulnerability is significant as it allows authenticated users with automation privileges to perform server-side request forgery attacks against internal systems that would normally be protected by network segmentation. This could enable attackers to access sensitive information from cloud metadata services, internal APIs, or other systems within the same network segment, potentially leading to credential theft, privilege escalation, or further lateral movement within the infrastructure. The vulnerability affects any environment where WACRM is deployed and users with automation privileges exist, making it particularly dangerous in multi-tenant or shared hosting environments.
The fix implemented in commit 23838a9959550e975d732ae08a44a3a2f0cc084b addresses this issue by integrating the existing isDeliverableUrl SSRF guard into the automation webhook validation process. This ensures that all webhook URLs submitted through the automation system undergo proper validation against known dangerous address ranges and network boundaries, preventing unauthorized access to internal resources. The remediation aligns with common security practices for preventing server-side request forgery attacks and follows established patterns for URL validation and network boundary enforcement.
This vulnerability maps directly to CWE-918 Server-Side Request Forgery and also relates to CWE-20 Improper Input Validation, as the system fails to properly validate user-provided webhook URLs before processing them. From an ATT&CK perspective, this represents a technique that could be used for initial access through privilege escalation or for information gathering, potentially leading to lateral movement within the network. The fix ensures proper input validation and follows security best practices for preventing SSRF attacks by implementing proper URL sanitization and network boundary checks before allowing any external requests to be processed by the server.
Organizations using WACRM should immediately update to versions after 0.7.0 to remediate this vulnerability, as the attack surface is limited to authenticated users with automation privileges but could potentially be exploited for credential theft or internal network reconnaissance. The fix demonstrates proper security implementation by incorporating existing security controls rather than introducing new ones, which aligns with defense-in-depth principles and reduces the risk of similar vulnerabilities in other system components.