NextCRM is an open-source CRM software where product catalog management is normally restricted to manager and admin roles. In version 0.12.1, the MCP product tools expose write operations through the /api/mcp/mcp endpoint using user-generated Bearer tokens but fail to enforce role-based access control. Consequently, any authenticated user able to generate an MCP API token can manipulate products in the shared catalog, bypassing intended privilege restrictions. This vulnerability is classified under CWE-269 (Improper Privilege Management), CWE-284 (Improper Access Control), and CWE-862 (Missing Authorization). A fix addressing this issue is included in version 0.12.3.

The vulnerability allows authenticated low-privileged users to create, modify, archive, or soft-delete products in the organization-wide CRM product catalog, potentially leading to unauthorized data manipulation and integrity loss. There is no indication of confidentiality impact. Availability impact is low but present due to possible unauthorized product modifications. The CVSS 3.1 base score is 7.1 (high), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

A fix is available in NextCRM version 0.12.3. Users and administrators should upgrade from version 0.12.1 to 0.12.3 or later to remediate this vulnerability. Until patched, restrict access to the MCP API tokens and monitor for unauthorized use. Patch status is not explicitly stated in the vendor advisory fields but the description confirms the fix in 0.12.3.