CVE-2026-47129

HIGH

NextCRM < 0.12.0 - Authenticated Account Activation Bypass

Title source: manual

Description

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the `admin` role. Consequently, any authenticated user (even those with the lowest `member` or `viewer` roles) can arbitrarily activate or deactivate any user account in the system, including the main administrator. Version 0.12.0 fixes the issue.

References (2)

Core 2

Core References

X_Refsource_Misc x_refsource_misc

https://github.com/pdovhomilja/nextcrm-app/releases/tag/v0.12.0

X_Refsource_Confirm x_refsource_confirm

https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-gm7p-f88p-vhfr

Scores

CVSS v3 8.1

EPSS 0.0022

EPSS Percentile 13.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (1)

pdovhomilja/nextcrm-app < 0.12.0

Published Jul 20, 2026

Tracked Since Jul 21, 2026