# CVE-2026-47130: pdovhomilja NextCRM IDOR in contact and target update endpoints

Source: https://junglewise.ai/threats/cve-2026-47130-pdovhomilja-nextcrm-idor-in-contact-and-target-update-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-47130 · Severity: high · CVSS 7.1 · Published 2026-07-20

NextCRM is an open-source customer relationship management platform used to manage business leads and contact information. A security flaw allows any logged-in user to modify contact records belonging to other users or organizations by simply knowing the record's ID. This could lead to widespread data tampering, where attackers replace legitimate business phone numbers or links with malicious ones to facilitate phishing or intercept business communications.

Technologies: [Pdovhomilja NextCRM](https://junglewise.ai/threats/technologies/nextcrm). Vendors: [Pdovhomilja](https://junglewise.ai/threats/vendors/pdovhomilja).

## Quick answers

**Is CVE-2026-47130 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47130 being exploited in the wild.

**How severe is CVE-2026-47130?** High severity, with a CVSS score of 7.1, published 20 July 2026.

**Which products and versions are affected?** Pdovhomilja NextCRM < 0.12.0.

**Is there a fix for CVE-2026-47130?** A patch was published on 2026-07-20: Version 0.12.0 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47130 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47130?** Check whether you run Pdovhomilja NextCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Broken Object Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), exists in the PATCH handlers for `/api/crm/contacts/[id]` and `/api/crm/targets/[id]`. The root cause is located in `app/api/crm/contacts/[id]/route.ts`, where the application performs a database update using only the `id` from the URL parameter without verifying if the `assignedTo` or `createdBy` fields match the authenticated user's session ID. An attacker with a standard 'member' role can provide a target UUID to overwrite sensitive fields such as `office_phone` or `social_linkedin`. This vulnerability enables cross-tenant data tampering and integrity loss. The issue is resolved in version 0.12.0.

## Affected products

- pdovhomilja nextcrm-app < 0.12.0

## Timeline

- 2026-05-17: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD
- 2026-07-20: patched: Version 0.12.0 released to address the vulnerability

## References

- [https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-mg5f-m89f-4gmc](https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-mg5f-m89f-4gmc)

## Related threats

- [NextCRM authorization bypass in MCP product tools](https://junglewise.ai/threats/cve-2026-55550-nextcrm-authorization-bypass-in-mcp-product-tools)
- [pdovhomilja NextCRM BOLA in MCP campaign tools](https://junglewise.ai/threats/cve-2026-55544-pdovhomilja-nextcrm-bola-in-mcp-campaign-tools)
- [NextCRM broken access control in user activation server actions](https://junglewise.ai/threats/cve-2026-47129-nextcrm-broken-access-control-in-user-activation-server-actions)