Executive brief
NextCRM is an open-source customer relationship management platform used to manage business leads and contact information. A security flaw allows any logged-in user to modify contact records belonging to other users or organizations by simply knowing the record's ID. This could lead to widespread data tampering, where attackers replace legitimate business phone numbers or links with malicious ones to facilitate phishing or intercept business communications.
Technical details
A Broken Object Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), exists in the PATCH handlers for `/api/crm/contacts/[id]` and `/api/crm/targets/[id]`. The root cause is located in `app/api/crm/contacts/[id]/route.ts`, where the application performs a database update using only the `id` from the URL parameter without verifying if the `assignedTo` or `createdBy` fields match the authenticated user's session ID. An attacker with a standard 'member' role can provide a target UUID to overwrite sensitive fields such as `office_phone` or `social_linkedin`. This vulnerability enables cross-tenant data tampering and integrity loss. The issue is resolved in version 0.12.0.
Affected products
- pdovhomilja nextcrm-app < 0.12.0
Timeline
- 2026-05-17: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD
- 2026-07-20: patched: Version 0.12.0 released to address the vulnerability