nextcrm-app vulnerabilities

4 known vulnerabilities in nextcrm-app from Pdovhomilja. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  nextcrm-app: Improper Privilege Management

  CVE-2026-55550Jul 20, 2026Pdovhomilja

  NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However,

• 7.6 High severity

  nextcrm-app: Improper Access Control

  CVE-2026-55544Jul 20, 2026Pdovhomilja

  NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens (`nxtc__...`). The application has an authorizat

• 7.1 High severity

  nextcrm-app: Authorization Bypass Through User-Controlled Key

  CVE-2026-47130Jul 20, 2026Pdovhomilja

  NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the au

• 8.1 High severity

  nextcrm-app: Missing Authorization

  CVE-2026-47129Jul 20, 2026Pdovhomilja

  NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions of NextCRM. The application fails to verify if t