Is CVE-2026-55544 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55544 being exploited in the wild.

How severe is CVE-2026-55544?

High severity, with a CVSS score of 7.6, published 20 July 2026.

Is there a fix for CVE-2026-55544?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-55544 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55544?

Check whether you run Pdovhomilja NextCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55544: pdovhomilja NextCRM BOLA in MCP campaign tools

CVE-2026-55544 · Severity: high · CVSS 7.6 · Published 2026-07-20

NextCRM, an open-source customer relationship management platform, contains a security flaw in its campaign management tools. An authorized user with low-level permissions can view, modify, or delete marketing campaigns belonging to other users or the organization. This could lead to the exposure of sensitive campaign data, unauthorized changes to marketing templates, or the disruption of scheduled communications, potentially damaging a company's reputation and operations.

Technologies: Pdovhomilja NextCRM. Vendors: Pdovhomilja.

Quick answers

Is CVE-2026-55544 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55544 being exploited in the wild.
How severe is CVE-2026-55544?: High severity, with a CVSS score of 7.6, published 20 July 2026.
Which products and versions are affected?: Pdovhomilja NextCRM 0.12.1.
Is there a fix for CVE-2026-55544?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-55544 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55544?: Check whether you run Pdovhomilja NextCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the MCP (Model Context Protocol) campaign handlers of NextCRM version 0.12.1. While the application's standard web interface enforces role-based and owner-based access controls, the MCP tool handlers (located in `lib/mcp/tools/campaigns.ts`) fail to validate the authenticated user's ID against the campaign's owner. An attacker with a valid Bearer API token can use the `campaigns_list` tool to enumerate all campaign IDs and subsequently use other tools to read, update, delete, or trigger campaign delivery for any campaign in the database. The vulnerability is exploited via network requests to the MCP API endpoints and is resolved in version 0.12.2 by re-integrating authorization scope checks.

Affected products

pdovhomilja nextcrm-app 0.12.1

Timeline

2026-06-13: advisory: GitHub Security Advisory published
2026-07-20: disclosed: CVE published to NVD

References

https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-c9vg-c532-ppqx

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.