What is the CVSS score of EUVD-2026-46110?

EUVD-2026-46110 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of NextCRM are affected by EUVD-2026-46110?

NextCRM 0.12.1 contains an authenticated privilege escalation vulnerability allowing low-privileged users to modify the organization-wide product catalog without authorization.

How to fix or mitigate EUVD-2026-46110?

Within 24 hours, identify all NextCRM 0.12.1 instances and audit product catalog modification logs for unauthorized changes by low-privileged users. Within 7 days, upgrade all affected deployments to NextCRM version 0.12.3 to apply the vendor patch. Within 30 days, verify upgrade completion across all systems and confirm that MCP product tools now properly enforce role-based access controls.

NextCRM EUVD-2026-46110

| CVE-2026-55550 HIGH

Improper Privilege Management (CWE-269)

2026-07-20 GitHub_M

Privilege Escalation Nextcrm App

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Network-reachable MCP endpoint (AV:N/AC:L), requires an authenticated low-privileged user with a token (PR:L, no UI); high integrity from unauthorized catalog writes, low availability from soft-delete/archive, no data disclosure (C:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 21:45 vuln.today

CVE Published

Jul 20, 2026 - 21:02 cve.org

HIGH 7.1

DescriptionCVE.org

NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools expose the same write operations through /api/mcp/mcp using user-generated Bearer tokens and do not enforce role checks. Any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. Version 0.12.3 contains a fix.

AnalysisAI

Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or soft-delete entries in the organization-wide product catalog by calling MCP product tools at /api/mcp/mcp with a self-generated Bearer token. While the standard application server restricts these write operations to manager and admin roles, the MCP interface omits the role checks entirely, giving a vertical privilege escalation over shared business data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as low-privileged user

Delivery

Generate MCP API Bearer token

Exploit

POST product write call to /api/mcp/mcp

Execution

Role check bypassed on MCP path

Persist

Create/modify/archive/soft-delete catalog products

Impact

Shared CRM data integrity compromised