CVE-2026-47129 PUBLISHED

NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts

Assigner: GitHub_M
Reserved: 18.05.2026 Published: 20.07.2026 Updated: 21.07.2026

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role. Consequently, any authenticated user (even those with the lowest member or viewer roles) can arbitrarily activate or deactivate any user account in the system, including the main administrator. Version 0.12.0 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS Score: 8.1

Product Status

Vendor pdovhomilja
Product nextcrm-app
Versions
  • Version < 0.12.0 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE