ArnasDon Wacrm up to 0.7.0 profiles_update 017_account_sharing.sql p_account_id privileges management

Summaryinfo

A vulnerability classified as critical has been found in ArnasDon Wacrm up to 0.7.0. Affected is an unknown function of the file supabase/migrations/017_account_sharing.sql of the component profiles_update. Performing a manipulation of the argument p_account_id results in privileges management. This vulnerability is reported as CVE-2026-77240. The attack is possible to be carried out remotely. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability classified as critical has been found in ArnasDon Wacrm up to 0.7.0. This affects some unknown processing of the file supabase/migrations/017_account_sharing.sql of the component profiles_update. The manipulation of the argument p_account_id with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/migrations/017_account_sharing.sql permits authenticated users to modify their own account_role and account_id, allowing a viewer to self-promote or move into another tenant and then access or modify tenant resources. Separately, match_ai_knowledge_fts and match_ai_knowledge_semantic in supabase/migrations/030_ai_knowledge.sql run as SECURITY DEFINER, accept a caller-controlled p_account_id, and omit an is_account_member check, allowing an authenticated non-member to read another tenant's knowledge-base chunks. This vulnerability is fixed with commit e01f7ed37184f972ace8fb2da5c3e37e56a6050f.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-77240 since 08/20/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

By approaching the search of inurl:supabase/migrations/017_account_sharing.sql it is possible to find vulnerable targets with Google Hacking.

Applying the patch e01f7ed37184f972ace8fb2da5c3e37e56a6050f is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• ArnasDon

Name

• Wacrm

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7.0

Website

• Product: https://github.com/ArnasDon/wacrm/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion