Broken Access Control in NextCRM user activation Server Actions (CVE-2026-47129)

NextCRM versions prior to 0.12.0 contain a Broken Access Control vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions. The application verifies only that a session exists, without checking whether the requesting user holds the `admin` role. As a result, any authenticated user - including those with the lowest `member` or `viewer` roles - can activate or deactivate any account in the system, including the main administrator account, enabling denial of service against the admin and unauthorized approval of pending accounts. Affected versions: - < 0.12.0 We recommend updating to: 0.12.0. CVSS 8.1 · our assessment: this_week Reference: https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-gm7p-f88p-vhfr Details: https://vuln.today/cve/CVE-2026-47129