What is the CVSS score of CVE-2026-47129?

CVE-2026-47129 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of NextCRM are affected by CVE-2026-47129?

NextCRM versions before 0.12.0 contain a privilege escalation vulnerability allowing any low-privilege user to disable administrator accounts, potentially locking legitimate administrators out of the…. A patch is available.

How to fix or mitigate CVE-2026-47129?

Within 24 hours, inventory all NextCRM instances and identify those running versions prior to 0.12.0; immediately upgrade to version 0.12.0 or later. Within 7 days, review administrative account activity logs from the period before patching to identify any deactivated admin accounts or suspicious privilege escalation attempts, and reactivate any legitimate accounts that were disabled. Within 30 days, perform a comprehensive access control audit of your NextCRM deployment to confirm that server actions correctly validate user roles and that non-administrative users cannot invoke admin-level operations.

NextCRM CVE-2026-47129

EUVD-2026-46107 HIGH

Missing Authorization (CWE-862)

2026-07-20 GitHub_M

Authentication Bypass Nextcrm App Pdovhomilja

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Any authenticated user can invoke the network-reachable Server Action (PR:L, AV:N, AC:L, UI:N); it alters and disables accounts (I:H, A:H) but exposes no data (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 20, 2026 - 23:18 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 21:33 vuln.today

Analysis Generated

Jul 20, 2026 - 21:33 vuln.today

CVE Published

Jul 20, 2026 - 20:34 cve.org

HIGH 8.1

DescriptionCVE.org

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role. Consequently, any authenticated user (even those with the lowest member or viewer roles) can arbitrarily activate or deactivate any user account in the system, including the main administrator. Version 0.12.0 fixes the issue.

AnalysisAI

Privilege escalation via broken access control in NextCRM (open-source CRM by pdovhomilja) before version 0.12.0 lets any authenticated low-privilege user (member or viewer) call the activateUser and deactivateUser Next.js Server Actions, which never verify the caller holds the admin role. An attacker can therefore toggle any account's active state - including deactivating the main administrator to lock legitimate admins out, or reactivating disabled accounts. No public exploit identified at time of analysis, but the fix is confirmed in release v0.12.0 and the root cause is well documented in the vendor security advisory.

Technical ContextAI

The affected component is a pair of Next.js Server Actions (server-side RPC-style functions invoked from React client components) in NextCRM, a TypeScript CRM application (CPE cpe:2.3:a:pdovhomilja:nextcrm-app). The root cause is CWE-862 (Missing Authorization): the activateUser/deactivateUser handlers authenticate the session but omit a role check, so the server trusts that only admins would ever reach that code path. Next.js Server Actions are directly invocable HTTP endpoints once a valid session exists, meaning any logged-in user can trigger them regardless of the UI they are shown. The v0.12.0 release notes show the fix was a broader authorization overhaul - introducing an authz module with a canonical AppRole type, AuthenticationError/AuthorizationError classes, and read/write scope-assertion helpers - indicating the vendor addressed missing role enforcement systematically rather than with a single one-off check.

RemediationAI

Upgrade to NextCRM v0.12.0 or later (Vendor-released patch: v0.12.0), which adds the missing role enforcement to the user activation Server Actions as part of a dedicated authz module; the patched release is at https://github.com/pdovhomilja/nextcrm-app/releases/tag/v0.12.0 and details are in advisory GHSA-gm7p-f88p-vhfr. If immediate upgrade is not possible, compensating controls are limited because the flaw lives in server-side handlers: restrict who can obtain any authenticated account by tightening self-registration and disabling or pruning low-privilege member/viewer accounts (trade-off: reduces legitimate collaboration), place the application behind a reverse proxy or WAF rule that blocks POST requests to the activateUser/deactivateUser Server Action endpoints for non-admin sessions if you can identify them (trade-off: brittle and may break admin functionality), and monitor for unexpected account activation/deactivation events so a locked-out admin can be quickly restored via direct database access. These are stopgaps only - the upgrade is the sole complete fix.