Log in / Sign up

Vulnerability details

CVE-2026-55544

pdovhomilja nextcrm-app

NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering

CVSS 3.1
7.6High

Official description

NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens (`nxtc__...`). The application has an authorization model that restricts normal users to campaigns they created, but multiple MCP campaign handlers ignore the authenticated user ID and query or mutate campaigns only by object ID. As a result, a low-privileged authenticated user with a valid MCP API token can enumerate all campaigns, read campaign details, update or delete campaigns owned by other users, modify campaign templates and steps, and potentially trigger or pause campaign delivery. Version 0.12.2 fixes the issue.

CVSS scores

ScoreVersionSourceVector
7.6High 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Affected products

VendorProductVersionsSource
pdovhomilja nextcrm-app = 0.12.1 CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-07-21
Last updated
2026-07-22
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.22%
Probability of exploitation in 30 days
12.8%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-284
    Improper Access Control
  • CWE-639
    Authorization Bypass Through User-Controlled Key
  • CWE-862
    Missing Authorization