CVE-2026-47130 in nextcrm-app
Summary
by MITRE • 07/21/2026
NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the specific resource being modified. This allows any authenticated user (even with a standard `member` role) to arbitrarily modify sensitive CRM contacts and targets belonging to other users or organizations (cross-tenant data tampering). Version 0.12.0 fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The NextCRM platform presents a critical security vulnerability classified as Broken Object Level Authorization or Insecure Direct Object Reference, which falls under CWE-639 and aligns with ATT&CK technique T1078.101 for Valid Accounts and T1566.202 for Spearphishing Attachment. This vulnerability exists in versions prior to 0.12.0 and specifically targets the contact and target update endpoints within the CRM system. The flaw represents a fundamental failure in access control mechanisms where the application does not properly validate whether authenticated users possess legitimate authorization to modify specific resources they are attempting to access.
The technical implementation of this vulnerability stems from inadequate object-level authorization checks within the application's backend services. When authenticated users attempt to update contact or target records through the affected endpoints, the system fails to perform proper ownership verification before executing the modification operations. This allows any authenticated user regardless of their role permissions to manipulate data belonging to other users or organizations within the same tenant environment. The vulnerability specifically affects the member role users who should have limited access but can exploit this weakness to perform cross-tenant data tampering operations.
The operational impact of this vulnerability extends beyond simple unauthorized data modification, as it enables comprehensive data integrity compromise across organizational boundaries. An attacker with a standard member account could potentially alter sensitive customer information, modify target profiles, or manipulate contact details belonging to other users within the same system instance. This creates significant risks for data confidentiality and integrity, particularly in multi-tenant environments where separation of data between different organizations is expected. The vulnerability essentially allows lateral movement and unauthorized data manipulation across user accounts within the same tenant space.
Organizations utilizing affected NextCRM versions face substantial risk exposure including potential data breaches, regulatory compliance violations, and operational disruptions. The fix implemented in version 0.12.0 addresses this by introducing proper object-level authorization checks that verify user ownership before permitting any modification operations. Security teams should prioritize immediate deployment of the patched version and conduct thorough access control reviews to ensure proper implementation of authorization mechanisms. Additionally, organizations should implement monitoring solutions to detect unauthorized access attempts and establish incident response procedures for potential exploitation of similar vulnerabilities in other applications. The vulnerability demonstrates the critical importance of robust access control implementations and proper authorization validation in multi-user environments where data separation is paramount.