NextCRM CVE-2026-47130

Requires a valid authenticated account on the target NextCRM instance - even the lowest 'member' role is sufficient (CVSS PR:L). The attacker must target the specific contact or target update endpoints and supply the object identifier of a record they do not own; the vulnerable code path is the update operation on CRM contacts and targets in versions prior to 0.12.0. Limiting factors: exploitation is confined to existing tenants/members (not anonymous internet attackers), it affects only contact and target objects (not necessarily every entity type), and it is closed on any instance already upgraded to 0.12.0. No special non-default configuration or user interaction is needed beyond holding an account.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) is internally consistent with the description: network-reachable, low complexity, requires a low-privilege authenticated account, no user interaction, high integrity impact from arbitrary record modification, and no availability impact. The main limiting factor is PR:L - the attacker must already hold a valid account on the target instance, which reduces the population of attackers to existing tenants/members rather than the open internet. No EPSS score was provided, the flaw is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automated exploitation; this reads as a genuine authorization defect but a moderate operational priority rather than an emergency. Note a minor tension: the endpoints are described as update (write) operations, yet the vector assigns C:L - confidentiality impact is likely incidental (e.g., record contents returned in the modify response) and integrity is the dominant impact; verify against the vendor advisory.

An attacker signs up for or is granted a standard 'member' account on a shared NextCRM instance, then sends a crafted update request to the contact or target endpoint substituting the object ID of a record owned by a different user or organization. Because the server never checks ownership, the attacker overwrites the victim's sensitive CRM data (e.g., contact details or sales targets). No user interaction or elevated privileges are required and, given AC:L, the request is straightforward to craft; no public POC is currently referenced.