CVE-2026-47130

Received Received - Intake

Broken Object Level Authorization in NextCRM

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the specific resource being modified. This allows any authenticated user (even with a standard `member` role) to arbitrarily modify sensitive CRM contacts and targets belonging to other users or organizations (cross-tenant data tampering). Version 0.12.0 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-47130

Affected Vendors & Products

Vendor	Product	Version / Range
nextcrm	nextcrm	to 0.12.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

NextCRM versions before 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability in contact and target update endpoints. The app does not check if an authenticated user owns the resource they are modifying, allowing any user to alter data belonging to others.

Detection Guidance

To detect this vulnerability, check if your NextCRM version is prior to 0.12.0. Use commands like 'curl -s http://your-nextcrm-instance/version' or inspect the application's footer for version details. Verify if authenticated users can modify contacts or targets belonging to other users by testing with different accounts.

Impact Analysis

An attacker with standard user access could modify sensitive CRM contacts or targets of other users or organizations. This could lead to data tampering, unauthorized changes, or potential data breaches affecting multiple users.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or modification. GDPR and HIPAA require strict access controls and data integrity; this flaw risks non-compliance due to potential data tampering and unauthorized exposure.

Mitigation Strategies

Immediately upgrade NextCRM to version 0.12.0 or later to patch the BOLA vulnerability. Ensure proper access controls are enforced for CRM contacts and targets. Review user roles and permissions to confirm standard members cannot modify resources outside their ownership.

Hi! I’m here to help you understand CVE-2026-47130. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70