EUVD-2026-46110Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network-reachable MCP endpoint (AV:N/AC:L), requires an authenticated low-privileged user with a token (PR:L, no UI); high integrity from unauthorized catalog writes, low availability from soft-delete/archive, no data disclosure (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools expose the same write operations through /api/mcp/mcp using user-generated Bearer tokens and do not enforce role checks. Any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. Version 0.12.3 contains a fix.
AnalysisAI
Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or soft-delete entries in the organization-wide product catalog by calling MCP product tools at /api/mcp/mcp with a self-generated Bearer token. While the standard application server restricts these write operations to manager and admin roles, the MCP interface omits the role checks entirely, giving a vertical privilege escalation over shared business data. No public exploit identified at time of analysis; the issue is fixed in version 0.12.3.
Technical ContextAI
NextCRM is an open-source, TypeScript/Next.js-based CRM that exposes an MCP (Model Context Protocol) endpoint at /api/mcp/mcp so that AI agents and integrations can invoke CRM operations using user-generated Bearer API tokens. The product catalog is a shared, org-wide business object whose create/update/delete paths in the normal server actions are gated behind manager/admin roles. The MCP product tools re-implement those same write operations but skip the authorization layer, so token possession alone is sufficient. This is a textbook CWE-269 (Improper Privilege Management) issue: two code paths reach the same sensitive operation, but only one enforces the role model, leaving the alternate (MCP) path as an unguarded parallel entry point.
RemediationAI
Upgrade to NextCRM 0.12.3, which contains the fix (Vendor-released patch: 0.12.3); consult the advisory at https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58 for details. If immediate upgrade is not possible, disable or block the MCP endpoint at /api/mcp/mcp (for example via a reverse-proxy/WAF rule or feature flag) so the unguarded product write tools cannot be reached - the side effect is that legitimate MCP/agent integrations for the product catalog stop working. As a further compensating control, restrict or revoke the ability of low-privileged users to generate MCP API Bearer tokens and rotate existing tokens, accepting that this limits automation for those accounts; additionally, audit the product catalog for unexpected creations, edits, archives, or soft-deletes made through MCP and monitor /api/mcp/mcp access logs until patched.
More in Nextcrm App
View allPrivilege escalation via broken access control in NextCRM (open-source CRM by pdovhomilja) before version 0.12.0 lets an
Broken access control in NextCRM 0.12.1 lets a low-privileged authenticated user with a valid MCP Bearer API token (`nxt
Cross-tenant data tampering in NextCRM (open-source CRM) before version 0.12.0 lets any authenticated user - including l
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today