Threat Intelligence Database

NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However, in version 0.12.1, the MCP product tools expose the same write operations through `/api/mcp/mcp` using user-generated Bearer tokens and do not enforce role checks. Any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. Version 0.12.3 contains a fix.

NextCRM version 0.12.1 contains an improper access control vulnerability in its MCP campaign tools. The application uses Bearer API tokens for authentication and restricts normal users to campaigns they created. However, multiple campaign handlers ignore the authenticated user ID and allow operations based solely on campaign object IDs. This flaw enables low-privileged authenticated users to enumerate, read, update, delete, and modify campaigns owned by other users, including campaign templates and steps, and potentially control campaign delivery. Version 0.12.2 addresses this issue.

NextCRM versions prior to 0.12.0 contain a Broken Object Level Authorization (BOLA) vulnerability in the contact and target update endpoints. This flaw allows any authenticated user, including those with a standard member role, to modify CRM contacts and targets belonging to other users or organizations without proper authorization. The vulnerability enables cross-tenant data tampering. Version 0.12.0 addresses and fixes this issue.

NextCRM versions prior to 0.12.0 contain a Broken Access Control vulnerability in the activateUser and deactivateUser Next.js Server Actions. The application does not verify if the requesting user has the admin role, allowing any authenticated user to activate or deactivate any user account, including administrators. This issue is fixed in version 0.12.0.