Executive brief
NextCRM is an open-source customer relationship management platform used to manage business contacts and sales workflows. A security flaw allows any logged-in user, regardless of their permission level, to activate or deactivate other user accounts. In practice, a malicious employee or user could lock administrators out of the system, causing a total service outage, or approve unauthorized accounts to gain further access.
Technical details
A Broken Access Control (BAC) vulnerability exists in the `activateUser` and `deactivateUser` Next.js Server Actions within NextCRM. The root cause is a missing authorization check in `actions/admin/users/deactivate-user.ts` and `activate-user.ts`; while the code verifies that a session exists, it fails to validate that the user possesses the 'admin' role. An authenticated attacker with low-level 'member' or 'viewer' privileges can send a crafted POST request to the Server Action endpoint with an arbitrary `userId`. This allows for a Denial of Service (DoS) by deactivating administrator accounts or unauthorized account approval. The issue is resolved in version 0.12.0 by implementing proper role-based access control (RBAC) checks.
Affected products
- pdovhomilja nextcrm-app < 0.12.0
Timeline
- 2026-05-08: patched: Version 0.12.0 released
- 2026-05-17: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD