CVE-2026-77240 Details

A vulnerability in WACRM versions through 0.7.0 allows for unauthorized modifications of account roles and IDs, leading to privilege escalation and cross-tenant data access. The issue arises from a row-level security policy that improperly allows users to update sensitive account information, which can be exploited to access or alter resources in other tenants. Additionally, two functions that read knowledge base data bypass security checks, enabling access to another tenant's information.

The vulnerability has been addressed by implementing a trigger that prevents unauthorized changes to the 'account_role' and 'account_id' columns when the request is made by an authenticated user. This ensures that only authorized functions can modify these sensitive fields. Additionally, the functions that previously bypassed security checks have been updated to enforce proper access controls, preventing cross-tenant knowledge base disclosures.