Medium 6.4Published Jul 30, 2026

CVE-2026-67530WACRM: SSRF via the automation `send_webhook` action

Updated under an hour ago (Oct 28, 2026, 9:10 AM ET)

Does this affect you?

It affects ArnasDon wacrm. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for ArnasDon wacrm

Exploited in the last 30 days

WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the server fetched without the existing isDeliverableUrl SSRF guard in src/lib/webhooks/ssrf.ts, allowing requests to private, loopback, link-local, or cloud metadata addresses such as the cloud metadata endpoint at 169.254.169.254. This vulnerability is fixed with commit 23838a9959550e975d732ae08a44a3a2f0cc084b.

CVSS: 6.4 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Jul 31, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

ArnasDon wacrm arnasdon:wacrm (from the name)	through 0.7.0	CNA record

References

References

https://github.com/ArnasDon/wacrm/security/advisories/GHSA-8jqh-598v-rfxc	x-refsource-confirm
https://github.com/ArnasDon/wacrm/commit/23838a9959550e975d732ae08a44a3a2f0cc084b	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.