Broken Access Control in NextCRM Affects User Account Management Functionality

CVE-2026-47129

What is CVE-2026-47129?

NextCRM, an open-source customer relationship management software, is impacted by a vulnerability that allows authenticated users, regardless of their role, to manipulate user accounts. Specifically, the activateUser and deactivateUser actions in Next.js Server Actions do not verify whether the requesting user has administrative privileges. This flaw enables users with minimal roles, such as 'member' or 'viewer,' to arbitrarily activate or deactivate any account, including that of the main administrator. Users are strongly advised to upgrade to version 0.12.0 or later to mitigate this risk. For detailed information, please refer to the official advisory and release notes.

References