Inadequate Role Enforcement in NextCRM API by PDovhomilja
CVE-2026-55550

7.1HIGH

Key Information:

Vendor

Pdovhomilja

Status
Nextcrm-app
Vendor
CVE Published:
20 July 2026

What is CVE-2026-55550?

NextCRM, an open-source CRM platform, is vulnerable due to a significant oversight in its API design in version 0.12.1. The MCP product tools enable product management operations without appropriate role validation. This flaw allows authenticated users with low privileges to manipulate the product catalog using user-generated Bearer tokens, resulting in unauthorized creation, modification, or deletion of products. Version 0.12.3 addresses this issue by implementing necessary role checks to enhance security.

Affected Version(s)

nextcrm-app = 0.12.1

References

https://github.com/pdovhomilja/nextcrm-app/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.