Executive brief
NextCRM, an open-source customer relationship management platform, contains a security flaw in its campaign management tools. An authorized user with low-level permissions can view, modify, or delete marketing campaigns belonging to other users or the organization. This could lead to the exposure of sensitive campaign data, unauthorized changes to marketing templates, or the disruption of scheduled communications, potentially damaging a company's reputation and operations.
Technical details
A Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the MCP (Model Context Protocol) campaign handlers of NextCRM version 0.12.1. While the application's standard web interface enforces role-based and owner-based access controls, the MCP tool handlers (located in `lib/mcp/tools/campaigns.ts`) fail to validate the authenticated user's ID against the campaign's owner. An attacker with a valid Bearer API token can use the `campaigns_list` tool to enumerate all campaign IDs and subsequently use other tools to read, update, delete, or trigger campaign delivery for any campaign in the database. The vulnerability is exploited via network requests to the MCP API endpoints and is resolved in version 0.12.2 by re-integrating authorization scope checks.
Affected products
- pdovhomilja nextcrm-app 0.12.1
Timeline
- 2026-06-13: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD