RBAC bypass in NextCRM MCP product tools (CVE-2026-55550)

In NextCRM version 0.12.1, the MCP product tools exposed via `/api/mcp/mcp` perform write operations on the shared CRM product catalog without enforcing role-based access controls. While normal server actions restrict product creation, modification, and deletion to `manager` and `admin` roles, the MCP handlers omit this check entirely. Any authenticated user with an MCP API token can create, modify, archive, or soft-delete products regardless of their assigned role. Affected versions: - 0.12.1 We recommend updating to: 0.12.3. CVSS 7.1 · our assessment: this_week Reference: https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58 Details: https://vuln.today/cve/CVE-2026-55550