ArnasDon vulnerabilities
We track 3 vulnerabilities in ArnasDon products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.
Latest ArnasDon vulnerabilities
- 9.9 Critical severity
wacrm: Authorization Bypass Through User-Controlled Key
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/migrations/017_account_sharing.sql permits authenticated users to modify their own account_role and account_id, allowing
- 8.1 High severity
wacrm: Improper Authorization
WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, WACRM flow and automation write routes authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security
- 7.1 High severity
wacrm: Authorization Bypass Through User-Controlled Key
WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify contacts belonging to other tenants by supplying an arbitrary caller-controlled contact_id in the POST