CVE-2026-55544 in NextCRM
Summary
by MITRE • 07/21/2026
NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens (`nxtc__...`). The application has an authorization model that restricts normal users to campaigns they created, but multiple MCP campaign handlers ignore the authenticated user ID and query or mutate campaigns only by object ID. As a result, a low-privileged authenticated user with a valid MCP API token can enumerate all campaigns, read campaign details, update or delete campaigns owned by other users, modify campaign templates and steps, and potentially trigger or pause campaign delivery. Version 0.12.2 fixes the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in NextCRM version 0.12.1 represents a critical authorization bypass flaw that undermines the application's core access control mechanisms. This issue manifests through the MCP campaign tools which expose network operations using user-generated Bearer API tokens with the prefix nxtc__. While the application implements a legitimate authorization model that should restrict normal users to campaigns they created, multiple campaign handlers exhibit a fundamental design flaw by ignoring the authenticated user ID during query and mutation operations. The system's failure to properly validate ownership context during these operations creates an exploitable gap in the access control implementation.
The technical nature of this vulnerability aligns with CWE-639, which describes authorization flaws that allow attackers to bypass access control checks. Specifically, this represents a case of insufficient authorization where the application fails to verify that the authenticated user has proper permissions for the requested operations. The vulnerability operates at the API level where campaign read and write operations are exposed without proper user context validation, allowing malicious actors to manipulate objects they should not have access to. This flaw is particularly dangerous because it affects multiple campaign operations including enumeration, reading details, updating, deleting, modifying templates, and controlling campaign delivery states.
The operational impact of this vulnerability extends beyond simple data exposure, as it enables a low-privileged user to perform destructive actions across the entire campaign ecosystem. An attacker with a valid MCP API token can enumerate all campaigns within the system, effectively bypassing the normal user isolation mechanisms that should protect individual campaign data. The ability to modify or delete campaigns owned by other users creates significant risks for business continuity and data integrity. Additionally, the capability to manipulate campaign templates and steps, along with triggering or pausing campaign delivery, provides attackers with substantial control over marketing operations and potentially sensitive customer interaction workflows.
The mitigation strategy requires immediate patching to version 0.12.2 which addresses the core authorization flaw. Organizations should implement comprehensive token management practices, including regular token rotation and monitoring for unusual API activity patterns. System administrators should review existing campaign access logs to identify any unauthorized activities that may have occurred during the vulnerable timeframe. Security teams should conduct thorough access control reviews to ensure all API endpoints properly validate user context and enforce proper authorization checks. The fix demonstrates the importance of maintaining proper session validation and ensuring that all operations requiring user context verify authentication state before executing privileged actions. This vulnerability highlights the critical need for consistent security practices throughout application development, particularly in multi-user environments where proper access control enforcement is essential for maintaining data integrity and system security.