SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-67530

MEDIUM · CVSS 6.4 EPSS 0.16% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-30 · Last synced 2026-08-29

CyberRota Analysis

AI-Generated

The vulnerability affects WACRM versions 0.7.0 and earlier, allowing authenticated users with automation privileges to submit arbitrary webhook URLs, bypassing the server's SSRF protection. This could lead to unauthorized access to internal services or sensitive data, including cloud metadata. Organizations using this CRM should prioritize updating to the latest version to mitigate potential exploitation risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-67530
Severity
MEDIUM
CVSS
6.4
EPSS
0.16%

Original NVD Description

WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the server fetched without the existing isDeliverableUrl SSRF guard in src/lib/webhooks/ssrf.ts, allowing requests to private, loopback, link-local, or cloud metadata addresses such as the cloud metadata endpoint at 169.254.169.254. This vulnerability is fixed with commit 23838a9959550e975d732ae08a44a3a2f0cc084b.