Skip to main content

NextCRM CVE-2026-55544

| EUVDEUVD-2026-46109 HIGH
Improper Access Control (CWE-284)
2026-07-20 GitHub_M
Authentication Bypass Nextcrm App
7.6
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.6 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
vuln.today AI
7.6 HIGH

Network MCP endpoint with low complexity but a valid low-privilege API token required (PR:L); cross-user write/delete drives I:H, with C:L for campaign reads and A:L for delivery pause/trigger.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Jul 20, 2026 - 21:45 vuln.today
CVE Published
Jul 20, 2026 - 20:57 cve.org
HIGH 7.6

DescriptionCVE.org

NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens (nxtc__...). The application has an authorization model that restricts normal users to campaigns they created, but multiple MCP campaign handlers ignore the authenticated user ID and query or mutate campaigns only by object ID. As a result, a low-privileged authenticated user with a valid MCP API token can enumerate all campaigns, read campaign details, update or delete campaigns owned by other users, modify campaign templates and steps, and potentially trigger or pause campaign delivery. Version 0.12.2 fixes the issue.

AnalysisAI

Broken access control in NextCRM 0.12.1 lets a low-privileged authenticated user with a valid MCP Bearer API token (nxtc__...) read, modify, and delete campaigns belonging to other users. Because multiple MCP campaign handlers query and mutate objects by ID alone while ignoring the authenticated user ID, an attacker can enumerate all campaigns, alter templates and steps, and trigger or pause delivery across tenant boundaries. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid MCP API token
Delivery
Call MCP campaign-list tool
Exploit
Enumerate campaigns of other users
Execution
Invoke update/delete by object ID
Persist
Tamper with templates or delivery
Impact
Cross-tenant data integrity loss
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires a valid NextCRM MCP Bearer API token (`nxtc__...`) tied to any authenticated account, and the deployment must have the MCP campaign tools enabled and network-reachable - these are the concrete prerequisites (consistent with PR:L, not PR:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, score 7.6) is internally consistent with the description: network-reachable MCP endpoint, low complexity, and a single low-privileged token required (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privileged user (or an attacker who has phished/stolen one `nxtc__` token) points an MCP client at the NextCRM endpoint and calls the campaign-list tool, which returns every campaign regardless of owner. They then invoke update/delete handlers by object ID to alter competitors' campaign templates, delete campaigns, or pause active delivery. …
Remediation Vendor-released patch: upgrade to NextCRM version 0.12.2, which restores the ownership check in the MCP campaign handlers; see the advisory at https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-c9vg-c532-ppqx. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all NextCRM 0.12.1 instances in production, immediately restrict MCP API token issuance to essential personnel only, and review system logs for evidence of unauthorized cross-tenant campaign access or modifications. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Nextcrm App

View all
CVE-2026-47129 HIGH
8.1 Jul 20

Privilege escalation via broken access control in NextCRM (open-source CRM by pdovhomilja) before version 0.12.0 lets an
CVE-2026-55550 HIGH
7.1 Jul 20

Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or

CVE-2026-47130 HIGH
7.1 Jul 20

Cross-tenant data tampering in NextCRM (open-source CRM) before version 0.12.0 lets any authenticated user - including l

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-55544 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy