CVE-2026-47129

Received Received - Intake

Broken Access Control in NextCRM

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the `admin` role. Consequently, any authenticated user (even those with the lowest `member` or `viewer` roles) can arbitrarily activate or deactivate any user account in the system, including the main administrator. Version 0.12.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-47129

Affected Vendors & Products

Vendor	Product	Version / Range
nextcrm	nextcrm	to 0.12.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

NextCRM is an open-source customer relationship management software. Versions before 0.12.0 have a Broken Access Control vulnerability in the activateUser and deactivateUser functions. The flaw allows any authenticated user, regardless of role, to activate or deactivate any user account, including the main administrator.

Detection Guidance

To detect this vulnerability, check if your NextCRM version is prior to 0.12.0. Inspect the activateUser and deactivateUser Server Actions for proper admin role verification. Test by attempting to activate or deactivate a user account with a non-admin account.

Impact Analysis

An attacker could gain unauthorized control over user accounts, disable critical accounts like the administrator, or activate dormant accounts for further attacks. This could lead to data breaches, unauthorized access, or system disruption.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access or modification of sensitive data, potentially breaching GDPR or HIPAA regulations. Organizations using affected versions may face legal penalties or loss of certification.

Mitigation Strategies

Immediately upgrade NextCRM to version 0.12.0 or later to fix the Broken Access Control vulnerability in activateUser and deactivateUser actions.

Hi! I’m here to help you understand CVE-2026-47129. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70