EUVD-2026-46107Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Any authenticated user can invoke the network-reachable Server Action (PR:L, AV:N, AC:L, UI:N); it alters and disables accounts (I:H, A:H) but exposes no data (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role. Consequently, any authenticated user (even those with the lowest member or viewer roles) can arbitrarily activate or deactivate any user account in the system, including the main administrator. Version 0.12.0 fixes the issue.
AnalysisAI
Privilege escalation via broken access control in NextCRM (open-source CRM by pdovhomilja) before version 0.12.0 lets any authenticated low-privilege user (member or viewer) call the activateUser and deactivateUser Next.js Server Actions, which never verify the caller holds the admin role. An attacker can therefore toggle any account's active state - including deactivating the main administrator to lock legitimate admins out, or reactivating disabled accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold any authenticated NextCRM session - even the lowest 'member' or 'viewer' role suffices; no admin role or additional configuration is needed because the activateUser/deactivateUser Server Actions perform no role check at all (PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H): network-reachable, low complexity, requires only low privileges (any authenticated account), no user interaction, with high integrity and availability impact but no confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A disgruntled employee or a compromised low-privilege account holder (member or viewer) in a shared NextCRM instance directly invokes the deactivateUser Server Action against the main administrator's user ID using nothing more than their normal session cookie. The admin is instantly locked out, and the attacker can additionally deactivate other staff to disrupt operations or reactivate previously disabled accounts. … |
| Remediation | Upgrade to NextCRM v0.12.0 or later (Vendor-released patch: v0.12.0), which adds the missing role enforcement to the user activation Server Actions as part of a dedicated authz module; the patched release is at https://github.com/pdovhomilja/nextcrm-app/releases/tag/v0.12.0 and details are in advisory GHSA-gm7p-f88p-vhfr. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all NextCRM instances and identify those running versions prior to 0.12.0; immediately upgrade to version 0.12.0 or later. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nextcrm App
View allBroken access control in NextCRM 0.12.1 lets a low-privileged authenticated user with a valid MCP Bearer API token (`nxt
Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or
Cross-tenant data tampering in NextCRM (open-source CRM) before version 0.12.0 lets any authenticated user - including l
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today