What is the CVSS score of CVE-2026-47130?

CVE-2026-47130 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of NextCRM are affected by CVE-2026-47130?

NextCRM instances running before version 0.12.0 are vulnerable to cross-tenant data tampering, allowing authenticated users with low-privilege access to modify customer contacts and targets belonging…. A patch is available.

How to fix or mitigate CVE-2026-47130?

Within 24 hours, audit all CRM access logs to identify unauthorized modifications to contacts and targets, and document affected data and users. Within 7 days, immediately restrict CRM access to authorized personnel only and enable comprehensive audit logging for all contact and target modifications. Within 30 days, once a patched version is released by the NextCRM project, validate and deploy the patch to all affected instances, restore any confirmed compromised records from clean backups, and implement strengthened role-based access controls to prevent low-privilege accounts from accessing data outside their scope.

NextCRM CVE-2026-47130

EUVD-2026-46108 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-20 GitHub_M

Authentication Bypass Nextcrm App Pdovhomilja

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

Network endpoint reachable by any logged-in member (PR:L, AC:L, UI:N); arbitrary cross-tenant record modification gives I:H, with only incidental C:L and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 20, 2026 - 23:18 EUVD

Analysis Generated

Jul 20, 2026 - 21:34 vuln.today

CVE Published

Jul 20, 2026 - 20:49 cve.org

HIGH 7.1

DescriptionCVE.org

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the specific resource being modified. This allows any authenticated user (even with a standard member role) to arbitrarily modify sensitive CRM contacts and targets belonging to other users or organizations (cross-tenant data tampering). Version 0.12.0 fixes the issue.

AnalysisAI

Cross-tenant data tampering in NextCRM (open-source CRM) before version 0.12.0 lets any authenticated user - including low-privilege 'member' accounts - modify CRM contacts and targets owned by other users or organizations. The contact and target update endpoints trust a client-supplied resource identifier without checking ownership, so an attacker who is a legitimate tenant on the instance can overwrite records outside their scope. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

NextCRM is a Next.js-based open-source customer relationship management application (CPE cpe:2.3:a:pdovhomilja:nextcrm-app). The root cause is CWE-639, Authorization Bypass Through User-Controlled Key, a form of Broken Object Level Authorization (BOLA/IDOR): the update handlers for contacts and targets accept an object identifier from the request and apply the change without verifying that the identifier belongs to the requesting user or their organization. In a multi-tenant CRM this collapses the tenant boundary at the object level - server-side authorization is performed at the authentication layer (is the caller logged in) but not at the per-record ownership layer.

RemediationAI

Vendor-released patch: upgrade to NextCRM 0.12.0 or later, which adds the missing ownership/authorization checks on the contact and target update endpoints; this is the primary and recommended fix per advisory GHSA-mg5f-m89f-4gmc (https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-mg5f-m89f-4gmc). Where an immediate upgrade is not possible, compensating controls include restricting instance membership to trusted users only and reducing the number of low-privilege 'member' accounts, since exploitation requires an authenticated account; enabling audit logging on contact/target modifications to detect cross-tenant tampering; and, if the deployment supports it, placing the update endpoints behind stricter per-organization access controls at a reverse proxy or middleware layer. The trade-off is that these controls limit blast radius and improve detection but do not close the underlying IDOR, so they are stopgaps until 0.12.0 is deployed.