EUVD-2026-46109Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Network MCP endpoint with low complexity but a valid low-privilege API token required (PR:L); cross-user write/delete drives I:H, with C:L for campaign reads and A:L for delivery pause/trigger.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens (nxtc__...). The application has an authorization model that restricts normal users to campaigns they created, but multiple MCP campaign handlers ignore the authenticated user ID and query or mutate campaigns only by object ID. As a result, a low-privileged authenticated user with a valid MCP API token can enumerate all campaigns, read campaign details, update or delete campaigns owned by other users, modify campaign templates and steps, and potentially trigger or pause campaign delivery. Version 0.12.2 fixes the issue.
AnalysisAI
Broken access control in NextCRM 0.12.1 lets a low-privileged authenticated user with a valid MCP Bearer API token (nxtc__...) read, modify, and delete campaigns belonging to other users. Because multiple MCP campaign handlers query and mutate objects by ID alone while ignoring the authenticated user ID, an attacker can enumerate all campaigns, alter templates and steps, and trigger or pause delivery across tenant boundaries. No public exploit identified at time of analysis; the issue is fixed in version 0.12.2.
Technical ContextAI
NextCRM is an open-source CRM (npm/GitHub project pdovhomilja/nextcrm-app) that exposes campaign functionality through Model Context Protocol (MCP) tools intended for programmatic/AI-agent access, authenticated via user-generated Bearer API tokens prefixed nxtc__. The root cause is CWE-284 (Improper Access Control), specifically an insecure-direct-object-reference pattern: the application's intended authorization model scopes normal users to campaigns they created, but the MCP campaign read/write handlers resolve the target campaign purely by object ID and omit an ownership check against the authenticated principal. The affected component is the MCP server layer that bridges network Bearer-token requests to campaign persistence (read, update, delete, template/step edit, and delivery control operations).
RemediationAI
Vendor-released patch: upgrade to NextCRM version 0.12.2, which restores the ownership check in the MCP campaign handlers; see the advisory at https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-c9vg-c532-ppqx. If you cannot upgrade immediately, disable the MCP campaign tools or the MCP token interface entirely (this removes the vulnerable code path but also disables any legitimate MCP-based automation), and revoke or rotate all outstanding nxtc__ Bearer API tokens to shrink the pool of accounts that could abuse the flaw. Additionally, restrict network access to the MCP endpoint to trusted hosts and audit campaign records for unexpected modification or deletion, since the flaw allows silent cross-user tampering that a post-incident review would need to detect.
More in Nextcrm App
View allPrivilege escalation via broken access control in NextCRM (open-source CRM by pdovhomilja) before version 0.12.0 lets an
Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or
Cross-tenant data tampering in NextCRM (open-source CRM) before version 0.12.0 lets any authenticated user - including l
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today