BOLA/IDOR in NextCRM MCP campaign tools (CVE-2026-55544)

Multiple MCP campaign tool handlers in NextCRM fail to enforce object-level authorization, ignoring the authenticated user's identity when querying or mutating campaigns. A low-privileged authenticated user holding a valid MCP API token can enumerate all campaigns, read campaign details, and update, delete, or control delivery of campaigns owned by other users. Affected versions: - 0.12.1 We recommend updating to: 0.12.2. CVSS 7.6 · our assessment: this_week Reference: https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-c9vg-c532-ppqx Details: https://vuln.today/cve/CVE-2026-55544