NextCRM EUVD-2026-46110

Exploitation requires (1) a NextCRM 0.12.1 deployment with the MCP interface at /api/mcp/mcp enabled, and (2) an authenticated low-privileged account able to generate an MCP API Bearer token - the CVSS PR:L reflects this authenticated prerequisite. Given a valid token, the attacker directly calls the MCP product tools; no manager/admin role, no user interaction, and no special client-side configuration are needed because the vulnerable path simply omits the role checks. What limits exploitation: the attacker must already possess valid credentials on the target instance and the MCP token-generation feature must be available to them, so purely external unauthenticated actors cannot exploit it, and deployments that disable MCP or restrict token issuance are not exposed.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, score 7.1) is internally consistent with the description: network-reachable, low complexity, requires low privileges (an authenticated user who can mint an MCP token), no user interaction, high integrity impact (unauthorized writes to shared data) and low availability impact (soft-delete/archive can remove products from view). Confidentiality is rated N, which is reasonable since the flaw concerns write operations rather than data disclosure. No EPSS score, KEV listing, or POC was supplied, so real-world exploitation pressure appears low-to-moderate and opportunistic rather than mass-exploited. The key limiting factor is the PR:L requirement - an attacker must already be a legitimate (if low-privileged) authenticated user of the specific NextCRM tenant - which materially narrows the threat to insiders or attackers who have obtained valid low-privilege credentials, keeping this below the tier of internet-wide unauthenticated RCE despite the network vector.

A low-privileged sales user of a shared NextCRM instance generates an MCP API token from their own account, then sends crafted requests to /api/mcp/mcp invoking the product write tools. Because no role check is enforced on that path, they archive or soft-delete competitors' products, alter pricing/details, or inject bogus catalog entries that every other tenant user sees. No user interaction or elevated role is required beyond holding a valid token, and no public POC is currently known.