NextCRM, an open-source CRM software, has a Broken Access Control vulnerability (CWE-862) in versions before 0.12.0. The vulnerability exists in the activateUser and deactivateUser Next.js Server Actions where the system fails to check if the user has admin privileges before allowing account activation or deactivation. As a result, any authenticated user, regardless of their role, can arbitrarily activate or deactivate user accounts, including the main administrator account. This could lead to unauthorized privilege escalation or denial of service against user accounts. The issue is resolved in version 0.12.0.

The vulnerability allows any authenticated user, even with minimal roles like member or viewer, to activate or deactivate any user account in the system, including administrators. This can lead to unauthorized account control, potential privilege escalation, and disruption of legitimate user access. The CVSS score of 8.1 reflects a high severity with network attack vector, low attack complexity, and no user interaction required.

Upgrade NextCRM to version 0.12.0 or later, where this Broken Access Control vulnerability is fixed. There is no official patch advisory beyond this version update. Until upgraded, restrict access to authenticated users carefully and monitor for suspicious account activation or deactivation activities.