NextCRM CVE-2026-55544

Requires a valid NextCRM MCP Bearer API token (nxtc__...) tied to any authenticated account, and the deployment must have the MCP campaign tools enabled and network-reachable - these are the concrete prerequisites (consistent with PR:L, not PR:N). The vulnerable handlers act on any campaign by object ID, so no ownership relationship to the target campaign is needed. Limiting factors: exploitation is not possible for a fully anonymous/unauthenticated attacker (a token must first be obtained), it is confined to instances that have turned on the MCP token feature, and it is bounded to the campaign subsystem rather than the whole application.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, score 7.6) is internally consistent with the description: network-reachable MCP endpoint, low complexity, and a single low-privileged token required (PR:L). The high integrity impact is the dominant driver - cross-user modification and deletion of campaigns - while confidentiality is rated Low (campaign metadata rather than bulk sensitive PII) and availability Low (delivery pause/trigger). No EPSS score, KEV listing, or POC was supplied, so real-world exploitation pressure cannot be quantified from the input; absence of a KEV entry means there is no evidence of active exploitation. The practical barrier is that an attacker must first obtain a valid MCP API token for any account, which limits this to insider or post-authentication scenarios rather than fully anonymous internet-wide exploitation. Net: a genuine multi-tenant authorization flaw worth prompt patching for any deployment that has enabled MCP tokens, but not an unauthenticated mass-exploitation risk on current signals.

A low-privileged user (or an attacker who has phished/stolen one nxtc__ token) points an MCP client at the NextCRM endpoint and calls the campaign-list tool, which returns every campaign regardless of owner. They then invoke update/delete handlers by object ID to alter competitors' campaign templates, delete campaigns, or pause active delivery. No public exploit code has been identified, but the attack requires only standard MCP tool calls and low complexity (AC:L).