| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 5.9 | $0-$5k | 0.00 |
Summary
A vulnerability was found in ArnasDon wacrm. It has been classified as problematic. Impacted is an unknown function. Performing a manipulation results in authorization. This vulnerability is reported as CVE-2026-49141. The attack is possible to be carried out remotely. No exploit exists. It is suggested to install a patch to address this issue.
Details
A vulnerability classified as problematic has been found in ArnasDon wacrm (unknown version). This affects an unknown code block. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in the POST request body without tenant ownership verification. Attackers can exploit the service-role client that bypasses row-level security to modify victim contact fields including name, email, and company across tenant boundaries using only a known contact UUID.
The weakness was disclosed by Midhun Mohanan. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-49141 since 05/27/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available.
Applying the patch 73041bfa6420f5e1ecbfa1dd4fa847d8529320f5 is able to eliminate this problem.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Vendor
Name
Website
- Product: https://github.com/ArnasDon/wacrm/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔒VulDB Reliability: 🔍
CNA CVSS-B Score: 🔒
CNA CVSS-BT Score: 🔒
CNA Vector: 🔒
CVSSv3
VulDB Meta Base Score: 6.0VulDB Meta Temp Score: 5.9
VulDB Base Score: 5.0
VulDB Temp Score: 4.8
VulDB Vector: 🔒
VulDB Reliability: 🔍
CNA Base Score: 7.1
CNA Vector (VulnCheck): 🔒
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Exploiting
Class: AuthorizationCWE: CWE-639 / CWE-285 / CWE-266
CAPEC: 🔒
ATT&CK: 🔒
Physical: No
Local: No
Remote: Yes
Availability: 🔒
Status: Not defined
EPSS Score: 🔒
EPSS Percentile: 🔒
Price Prediction: 🔍
Current Price Estimation: 🔒
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔒
Patch: 73041bfa6420f5e1ecbfa1dd4fa847d8529320f5
Timeline
05/27/2026 CVE reserved06/08/2026 Advisory disclosed
06/08/2026 VulDB entry created
06/08/2026 VulDB entry last update
Sources
Product: github.comAdvisory: github.com
Researcher: Midhun Mohanan
Status: Confirmed
CVE: CVE-2026-49141 (🔒)
GCVE (CVE): GCVE-0-2026-49141
GCVE (VulDB): GCVE-100-369297
Entry
Created: 06/08/2026 22:08Changes: 06/08/2026 22:08 (74)
Complete: 🔍
Cache ID: 216::103
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
No comments yet. Languages: en.
Please log in to comment.