NextCRM, an open-source CRM software, has a Broken Access Control vulnerability (CWE-862) in versions before 0.12.0. The vulnerability exists in the activateUser and deactivateUser Next.js Server Actions, where the system fails to check if the requester holds the admin role. As a result, any authenticated user, regardless of their role (member, viewer, etc.), can arbitrarily activate or deactivate any user account, including the main administrator account. This flaw allows unauthorized modification of user account states, potentially disrupting administrative control. The issue is resolved in version 0.12.0.

Any authenticated user can activate or deactivate any user account, including administrator accounts, leading to unauthorized privilege manipulation and potential denial of service or administrative lockout. The integrity and availability of user accounts are compromised, but confidentiality is not directly affected.

Upgrade NextCRM to version 0.12.0 or later, where this Broken Access Control vulnerability is fixed. No official patch or temporary fix is indicated beyond upgrading. Until upgrade, restrict access to authenticated users carefully and monitor user account changes if possible.