A critical authorization bypass vulnerability in ArnasDon wacrm allows authenticated users to escalate privileges and access sensitive data belonging to other tenants.

The application suffers from flawed row-level security policies and insecure SQL functions that fail to validate account membership, allowing an authenticated user to perform unauthorized actions across tenant boundaries.

The exploitation of this vulnerability permits unauthorized data access and modification, which poses a severe risk to customer privacy and data integrity. Given the 9.9 CVSS score, this flaw represents an extreme risk to the business, as it allows attackers to bypass core security controls and compromise the entire CRM environment.

Immediate Action: Apply the fix provided in commit e01f7ed37184f972ace8fb2da5c3e37e56a6050f and update to the latest available version of wacrm.

Proactive Monitoring: Audit database access logs for suspicious cross-tenant queries or unauthorized modifications to user roles and account identifiers.

Compensating Controls: Implement strict database-level access controls and review existing row-level security policies to ensure that all user-controlled inputs are validated against current session context.

Public Exploit Available: No

Due to the critical nature of this vulnerability and the potential for complete tenant compromise, administrators must prioritize the application of the vendor-provided patch immediately. Verify that all instances are updated beyond version 0.7.0 and conduct a thorough review of existing user permissions to ensure no unauthorized escalation has already occurred.