A high-severity authorization bypass vulnerability in ArnasDon WACRM allows authenticated users to perform unauthorized write actions and manipulate automations, posing a significant risk to workflow integrity.

This vulnerability, classified as CWE-285, occurs because the application performs membership-only checks but fails to enforce specific agent roles before utilizing a service-role database client that circumvents row-level security. The flaw affects multiple API routes in the flows and automations modules, allowing any authenticated viewer to execute operations intended only for authorized agents.

The ability for unauthorized users to modify or delete workflows and trigger outbound WhatsApp actions represents a severe integrity risk. This could lead to the corruption of customer communication channels, the unauthorized execution of business logic, and potential reputational damage. Given the CVSS score of 8.1, this vulnerability is considered High, as it enables significant impact on the confidentiality and integrity of the CRM automation processes.

Immediate Action: Update the WACRM installation to the version incorporating commit 03e851bea56dcf6bb21ff1b80ba531372bf3269f to ensure proper role-based authorization is enforced.

Proactive Monitoring: Review application access logs for suspicious API requests targeting flow or automation endpoints, particularly those originating from accounts with read-only permissions.

Compensating Controls: Implement strict network-level access controls or a Web Application Firewall (WAF) to restrict access to the affected API routes to known, trusted administrator IP addresses until the patch is applied.

Public Exploit Available: No

The severity of this vulnerability necessitates immediate attention to prevent the unauthorized manipulation of CRM workflows. Organizations currently utilizing WACRM version 0.7.0 or earlier must prioritize the application of the vendor-provided fix to remediate the broken authorization logic and restore proper security boundaries.