PT-2026-61737 · Nextcrm · Nextcrm

CVE-2026-55550 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions NextCRM versions 0.12.1 through 0.12.2

Description NextCRM allows authenticated low-privileged users to perform unauthorized write operations on the shared CRM product catalog. While standard application server actions restrict product creation, updates, and deletions to manager and admin roles, the MCP product tools fail to enforce these role checks. An attacker with a user-generated Bearer token can use the /api/mcp/mcp endpoint to create, modify, archive, or soft-delete products.

Recommendations Update to version 0.12.3.

Exploit

Fix

Improper Privilege Management

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-269

CWE-284

CWE-862

Related Identifiers

CVE-2026-55550

Affected Products

Nextcrm

References · 3

• 🔥 https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-55550 · Security Note
• https://twitter.com/VulmonFeeds/status/2079445335655563352 · Twitter Post