NextCRM (pdovhomilja nextcrm-app) version 0.12.1 has an authorization bypass vulnerability (CWE-284) in its MCP campaign handlers. These handlers ignore the authenticated user ID and perform campaign operations solely based on object IDs. As a result, low-privileged authenticated users with valid Bearer API tokens can enumerate all campaigns, read details, update or delete campaigns owned by others, modify campaign templates and steps, and potentially trigger or pause campaign delivery. This improper access control flaw allows unauthorized access and modification of campaign data. The vulnerability is addressed in version 0.12.2.

An attacker with low privileges and a valid MCP API token can access and manipulate campaigns owned by other users. This includes unauthorized reading of campaign details, modification or deletion of campaigns, alteration of campaign templates and steps, and control over campaign delivery processes. The vulnerability compromises confidentiality, integrity, and availability of campaign data within the NextCRM application.

Upgrade NextCRM to version 0.12.2 or later, where this improper access control vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, restrict access to MCP API tokens and monitor for suspicious activity related to campaign management.