CVE-2026-55550 Details
Description
NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However, in version 0.12.1, the MCP product tools expose the same write operations through `/api/mcp/mcp` using user-generated Bearer tokens and do not enforce role checks. Any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. Version 0.12.3 contains a fix.
A role-based access control (RBAC) bypass vulnerability has been identified in NextCRM version 0.12.1. The issue arises in the MCP product tools, which expose write operations to the CRM product catalog via the '/api/mcp/mcp' endpoint. This is done using user-generated Bearer tokens without enforcing role checks. As a result, any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. In contrast, normal application server actions restrict these operations to 'manager' and 'admin' roles'. Version 0.12.3 addresses this vulnerability.
Users can update to NextCRM version 0.12.3, which includes a fix for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NextCRM | 0.12.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | New CVE Received | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |