Nextcrm App
Monthly
Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or soft-delete entries in the organization-wide product catalog by calling MCP product tools at /api/mcp/mcp with a self-generated Bearer token. While the standard application server restricts these write operations to manager and admin roles, the MCP interface omits the role checks entirely, giving a vertical privilege escalation over shared business data. No public exploit identified at time of analysis; the issue is fixed in version 0.12.3.
Broken access control in NextCRM 0.12.1 lets a low-privileged authenticated user with a valid MCP Bearer API token (`nxtc__...`) read, modify, and delete campaigns belonging to other users. Because multiple MCP campaign handlers query and mutate objects by ID alone while ignoring the authenticated user ID, an attacker can enumerate all campaigns, alter templates and steps, and trigger or pause delivery across tenant boundaries. No public exploit identified at time of analysis; the issue is fixed in version 0.12.2.
Cross-tenant data tampering in NextCRM (open-source CRM) before version 0.12.0 lets any authenticated user - including low-privilege 'member' accounts - modify CRM contacts and targets owned by other users or organizations. The contact and target update endpoints trust a client-supplied resource identifier without checking ownership, so an attacker who is a legitimate tenant on the instance can overwrite records outside their scope. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation via broken access control in NextCRM (open-source CRM by pdovhomilja) before version 0.12.0 lets any authenticated low-privilege user (member or viewer) call the activateUser and deactivateUser Next.js Server Actions, which never verify the caller holds the admin role. An attacker can therefore toggle any account's active state - including deactivating the main administrator to lock legitimate admins out, or reactivating disabled accounts. No public exploit identified at time of analysis, but the fix is confirmed in release v0.12.0 and the root cause is well documented in the vendor security advisory.
Improper privilege enforcement in NextCRM 0.12.1 lets any authenticated low-privileged user create, modify, archive, or soft-delete entries in the organization-wide product catalog by calling MCP product tools at /api/mcp/mcp with a self-generated Bearer token. While the standard application server restricts these write operations to manager and admin roles, the MCP interface omits the role checks entirely, giving a vertical privilege escalation over shared business data. No public exploit identified at time of analysis; the issue is fixed in version 0.12.3.
Broken access control in NextCRM 0.12.1 lets a low-privileged authenticated user with a valid MCP Bearer API token (`nxtc__...`) read, modify, and delete campaigns belonging to other users. Because multiple MCP campaign handlers query and mutate objects by ID alone while ignoring the authenticated user ID, an attacker can enumerate all campaigns, alter templates and steps, and trigger or pause delivery across tenant boundaries. No public exploit identified at time of analysis; the issue is fixed in version 0.12.2.
Cross-tenant data tampering in NextCRM (open-source CRM) before version 0.12.0 lets any authenticated user - including low-privilege 'member' accounts - modify CRM contacts and targets owned by other users or organizations. The contact and target update endpoints trust a client-supplied resource identifier without checking ownership, so an attacker who is a legitimate tenant on the instance can overwrite records outside their scope. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Privilege escalation via broken access control in NextCRM (open-source CRM by pdovhomilja) before version 0.12.0 lets any authenticated low-privilege user (member or viewer) call the activateUser and deactivateUser Next.js Server Actions, which never verify the caller holds the admin role. An attacker can therefore toggle any account's active state - including deactivating the main administrator to lock legitimate admins out, or reactivating disabled accounts. No public exploit identified at time of analysis, but the fix is confirmed in release v0.12.0 and the root cause is well documented in the vendor security advisory.