Skip to content

Back to the catalog

nvd.nist.govadvisory

CVE-2026-55544: NextCRM is open-source customer relationship management (CRM) software

CVE-2026-55544 describes an authorization bypass (IDOR/BOLA) in NextCRM CRM version 0.12.1, where MCP campaign tool handlers accept user-generated Bearer API tokens but query and mutate campaigns purely by object ID, ignoring the authenticated user's ownership scope. A low-privileged user with a valid MCP token can enumerate, read, modify, delete, or trigger/pause campaigns belonging to other users. Fixed in NextCRM 0.12.2.

TL;DR NextCRM's MCP campaign tools let any authenticated user read/write other users' campaigns via ID-based access control failure, fixed in 0.12.2.
Open original ↗
Document

What it is

CVE-2026-55544 is an authorization bypass in NextCRM (open-source CRM) version 0.12.1, scored CVSS 3.1 base 7.6 HIGH (vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L). It is classified under CWE-284 (improper access control), CWE-639 (authorization bypass via user-controlled key / IDOR), and CWE-862 (missing authorization). Published 2026-07-20; status Deferred. Fixed in 0.12.2.

How it works

NextCRM's MCP campaign tools expose read and write operations over the network authenticated by user-generated Bearer API tokens with the prefix nxtc__. The application's authorization model is supposed to restrict normal users to campaigns they created, but multiple MCP campaign handlers ignore the authenticated user ID and query or mutate campaigns solely by object ID. The CVSS vector reflects the impact shape: low confidentiality but high integrity (I:H) and low availability — i.e., the damage is primarily in unauthorized modification/deletion, not bulk data theft.

Preconditions / Affected

  • NextCRM 0.12.1.
  • Attacker is a low-privileged, authenticated user (PR:L) holding a valid nxtc__ MCP API token.
  • MCP campaign tooling reachable over the network (AV:N, no user interaction).

What to do

Upgrade to NextCRM 0.12.2, which fixes the issue. Review the advisory for specifics:

For detection/hunting before patching: nxtc__-prefixed tokens are the credential involved, so audit MCP campaign access by these tokens and look for a single user touching campaign object IDs it did not create — enumeration, cross-owner update/delete, template/step edits, or trigger/pause calls.

Caveats

The C:L rating suggests the confidentiality exposure is scoped rather than full-database; the emphasis is on integrity (modifying, deleting, or triggering/pausing other users' campaigns). "Deferred" status means NVD is not prioritizing further enrichment — the score and CWEs above are what's on record.

Organisations named here

  • CWE-284

CVEs named here

  • CVE-2026-55544

Technologies named here

  • NextCRM
  • Model Context Protocol

Techniques named here

  • Authorization bypass through user-controlled key
  • Missing Authorization
  • IDOR
  • BOLA

Related in AppSec