CVE-2026-55550

Received Received - Intake

Unauthorized Product Manipulation in NextCRM via MCP API

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However, in version 0.12.1, the MCP product tools expose the same write operations through `/api/mcp/mcp` using user-generated Bearer tokens and do not enforce role checks. Any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. Version 0.12.3 contains a fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-55550

Affected Vendors & Products

Vendor	Product	Version / Range
nextcrm	nextcrm	to 0.12.3 (exc)
nextcrm	nextcrm	0.12.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

NextCRM is open-source customer relationship management software. In version 0.12.1, the MCP product tools expose product catalog write operations through an API endpoint without proper role-based access control. This allows any authenticated low-privileged user with an MCP API token to create, modify, archive, or soft-delete products in the shared CRM product catalog.

Detection Guidance

Check NextCRM version for 0.12.1. Inspect API logs for unauthorized POST/PUT/DELETE requests to /api/mcp/mcp with Bearer tokens. Monitor product catalog changes by low-privileged users.

Impact Analysis

An attacker could manipulate the product catalog by creating unauthorized products, altering existing ones, or deleting them. This could disrupt business operations, lead to incorrect product information being displayed, or cause financial losses due to inventory or pricing errors.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized modifications to sensitive data in the CRM system. For GDPR, it may lead to unauthorized data changes affecting user information. For HIPAA, it could compromise protected health information integrity if product catalog data includes health-related details.

Mitigation Strategies

Upgrade NextCRM to version 0.12.3 or later. Restrict MCP API token generation to admin roles only. Review and revoke any unauthorized Bearer tokens. Monitor product catalog for suspicious changes.

Hi! I’m here to help you understand CVE-2026-55550. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70