CVE-2026-67530

Deferred Deferred - Pending Action

Authenticated SSRF via Arbitrary Webhook URL in WACRM CRM Template

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an authenticated user with automation privileges to submit an arbitrary webhook URL that the server fetched without the existing isDeliverableUrl SSRF guard in src/lib/webhooks/ssrf.ts, allowing requests to private, loopback, link-local, or cloud metadata addresses such as the cloud metadata endpoint at 169.254.169.254. This vulnerability is fixed with commit 23838a9959550e975d732ae08a44a3a2f0cc084b.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-67530

EUVD

EUVD-2026-51294

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability in WACRM (versions 0.7.0 and earlier) allows an authenticated user with automation privileges to send a webhook to any URL, including internal or private addresses like 169.254.169.254, bypassing SSRF protections. The issue is in the send_webhook action and its validation, which did not enforce the isDeliverableUrl guard.

Detection Guidance

Check WACRM automation logs for outbound webhook requests to unusual or internal IP addresses. Monitor network traffic for connections to private, loopback, or cloud metadata endpoints like 169.254.169.254. Review automation configurations for unauthorized webhook URLs.

Impact Analysis

An attacker could exploit this to send requests to internal systems, potentially accessing sensitive data or services. This could lead to data breaches, unauthorized access, or further network compromise if the webhook interacts with internal APIs or databases.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data to unauthorized systems or HIPAA by allowing access to protected health information. It undermines data protection requirements by enabling unauthorized data exfiltration or access to sensitive systems.

Mitigation Strategies

Update WACRM to a version that includes commit 23838a9959550e975d732ae08a44a3a2f0cc084b. Disable automation privileges for users until patched. Inspect existing automations for suspicious webhook URLs and remove unauthorized entries.

Hi! I’m here to help you understand CVE-2026-67530. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70