CVE-2026-55550

NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However, in version 0.12.1, the MCP product tools expose the same write operations through `/api/mcp/mcp` using user-generated Bearer tokens and do not enforce role checks. Any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. Version 0.12.3 contains a fix.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58
https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58

Configurations

No configuration.

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) NextCRM es un software de gestión de relaciones con clientes (CRM) de código abierto. El catálogo de productos de CRM es un objeto de negocio a nivel de toda la organización. Las acciones normales del servidor de aplicaciones restringen la creación, actualización y eliminación de productos a los roles de ’manager’ y ’admin’. Sin embargo, en la versión 0.12.1, las herramientas de productos de MCP exponen las mismas operaciones de escritura a través de ’/api/mcp/mcp’ utilizando tokens Bearer generados por el usuario y no aplican comprobaciones de rol. Cualquier usuario autenticado con bajos privilegios que pueda generar un token de API de MCP puede crear, modificar, archivar o eliminar de forma lógica productos en el catálogo de productos de CRM compartido. La versión 0.12.3 contiene una corrección.

Information

Published : 2026-07-20 22:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-55550

Mitre link : CVE-2026-55550

CVE.ORG link : CVE-2026-55550

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

CWE-284

Improper Access Control

CWE-862

Missing Authorization

{"id": "CVE-2026-55550", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55550", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T21:41:25.686655Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pdovhomilja", "product": "nextcrm-app", "versions": [{"status": "affected", "version": "= 0.12.1"}]}]}], "published": "2026-07-20T22:17:16.543", "references": [{"url": "https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58", "source": "security-advisories@github.com"}, {"url": "https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However, in version 0.12.1, the MCP product tools expose the same write operations through `/api/mcp/mcp` using user-generated Bearer tokens and do not enforce role checks. Any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. Version 0.12.3 contains a fix."}, {"lang": "es", "value": "NextCRM es un software de gesti\u00f3n de relaciones con clientes (CRM) de c\u00f3digo abierto. El cat\u00e1logo de productos de CRM es un objeto de negocio a nivel de toda la organizaci\u00f3n. Las acciones normales del servidor de aplicaciones restringen la creaci\u00f3n, actualizaci\u00f3n y eliminaci\u00f3n de productos a los roles de \u2019manager\u2019 y \u2019admin\u2019. Sin embargo, en la versi\u00f3n 0.12.1, las herramientas de productos de MCP exponen las mismas operaciones de escritura a trav\u00e9s de \u2019/api/mcp/mcp\u2019 utilizando tokens Bearer generados por el usuario y no aplican comprobaciones de rol. Cualquier usuario autenticado con bajos privilegios que pueda generar un token de API de MCP puede crear, modificar, archivar o eliminar de forma l\u00f3gica productos en el cat\u00e1logo de productos de CRM compartido. La versi\u00f3n 0.12.3 contiene una correcci\u00f3n."}], "lastModified": "2026-10-24T20:10:00.137", "sourceIdentifier": "security-advisories@github.com"}