EUVD-2026-46108Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network endpoint reachable by any logged-in member (PR:L, AC:L, UI:N); arbitrary cross-tenant record modification gives I:H, with only incidental C:L and no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the specific resource being modified. This allows any authenticated user (even with a standard member role) to arbitrarily modify sensitive CRM contacts and targets belonging to other users or organizations (cross-tenant data tampering). Version 0.12.0 fixes the issue.
AnalysisAI
Cross-tenant data tampering in NextCRM (open-source CRM) before version 0.12.0 lets any authenticated user - including low-privilege 'member' accounts - modify CRM contacts and targets owned by other users or organizations. The contact and target update endpoints trust a client-supplied resource identifier without checking ownership, so an attacker who is a legitimate tenant on the instance can overwrite records outside their scope. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated account on the target NextCRM instance - even the lowest 'member' role is sufficient (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) is internally consistent with the description: network-reachable, low complexity, requires a low-privilege authenticated account, no user interaction, high integrity impact from arbitrary record modification, and no availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker signs up for or is granted a standard 'member' account on a shared NextCRM instance, then sends a crafted update request to the contact or target endpoint substituting the object ID of a record owned by a different user or organization. Because the server never checks ownership, the attacker overwrites the victim's sensitive CRM data (e.g., contact details or sales targets). … |
| Remediation | Vendor-released patch: upgrade to NextCRM 0.12.0 or later, which adds the missing ownership/authorization checks on the contact and target update endpoints; this is the primary and recommended fix per advisory GHSA-mg5f-m89f-4gmc (https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-mg5f-m89f-4gmc). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all CRM access logs to identify unauthorized modifications to contacts and targets, and document affected data and users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nextcrm App
View allPrivilege escalation via broken access control in NextCRM (open-source CRM by pdovhomilja) before version 0.12.0 lets an
Broken access control in NextCRM 0.12.1 lets a low-privileged authenticated user with a valid MCP Bearer API token (`nxt
Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today