Verified Advisories
Concise advisories for CRITICAL/HIGH vulnerabilities – affected and fixed versions confirmed against the vendor's own advisory before publishing. 4 total.
BOLA/IDOR in NextCRM MCP campaign tools (CVE-2026-55544)
Multiple MCP campaign tool handlers in NextCRM fail to enforce object-level authorization, ignoring the authenticated user's identity when querying or mutating campaigns. A low-privileged authenticated user holding a ...
Fixed in 0.12.2
RBAC bypass in NextCRM MCP product tools (CVE-2026-55550)
In NextCRM version 0.12.1, the MCP product tools exposed via `/api/mcp/mcp` perform write operations on the shared CRM product catalog without enforcing role-based access controls. While normal server actions restrict...
Fixed in 0.12.3
Broken Object Level Authorization in NextCRM CRM contact and target endpoints (CVE-2026-47130)
NextCRM versions prior to 0.12.0 contain a Broken Object Level Authorization (BOLA/IDOR) vulnerability in the CRM contact and target update endpoints. The PATCH handlers verify only that a session exists, but fail to ...
Fixed in 0.12.0
Broken Access Control in NextCRM user activation Server Actions (CVE-2026-47129)
NextCRM versions prior to 0.12.0 contain a Broken Access Control vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions. The application verifies only that a session exists, without checking w...
Fixed in 0.12.0