Broken Object Level Authorization in NextCRM CRM contact and target endpoints (CVE-2026-47130)

NextCRM versions prior to 0.12.0 contain a Broken Object Level Authorization (BOLA/IDOR) vulnerability in the CRM contact and target update endpoints. The PATCH handlers verify only that a session exists, but fail to confirm that the authenticated user owns the resource being modified, allowing any authenticated user - including those with a standard member role - to overwrite CRM contacts and targets belonging to other users or organizations. Affected versions: - < 0.12.0 We recommend updating to: 0.12.0. CVSS 7.1 · our assessment: this_week Reference: https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-mg5f-m89f-4gmc Details: https://vuln.today/cve/CVE-2026-47130