PT-2026-61716 · Nextcrm · Nextcrm

CVE-2026-47129 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions NextCRM versions prior to 0.12.0

Description NextCRM contains a Broken Access Control (BAC) issue, which occurs when a system fails to properly enforce restrictions on what authenticated users are allowed to do. The application does not verify if the requesting user possesses the admin role when calling the activateUser() and deactivateUser() Next.js Server Actions. This allows any authenticated user, regardless of their role, to arbitrarily activate or deactivate any user account, including the main administrator.

Recommendations Update to version 0.12.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-47129

Affected Products

Nextcrm

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-47129 · Security Note
• https://github.com/pdovhomilja/nextcrm-app/releases/tag/v0.12.0 · Note
• https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-gm7p-f88p-vhfr · Note
• https://twitter.com/CVEnew/status/2079318783760486491 · Twitter Post
• https://twitter.com/infoflowcloud/status/2079319360909250636 · Twitter Post