CVE-2026-47129 Details
Description
NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the `admin` role. Consequently, any authenticated user (even those with the lowest `member` or `viewer` roles) can arbitrarily activate or deactivate any user account in the system, including the main administrator. Version 0.12.0 fixes the issue.
A broken access control vulnerability has been identified in NextCRM versions prior to 0.12.0. This vulnerability exists in the Next.js server actions responsible for activating and deactivating user accounts. The application does not properly verify whether the user making the request has administrative privileges. As a result, any authenticated user, including those with minimal roles such as 'member' or 'viewer', can activate or deactivate any user account, including that of the main administrator. This issue has been addressed in version 0.12.0.
Role-based authorization checks should be implemented in all administrative server actions to ensure that only users with the appropriate privileges can perform sensitive operations.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-gm7p-f88p-vhfr | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pdovhomilja/nextcrm-app/releases/tag/v0.12.0 | [email protected] | Release NotesVendor |
| https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-gm7p-f88p-vhfr | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NextCRM | < 0.12.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |