CyberRota Analysis
AI-GeneratedNextCRM versions prior to 0.12.0 are vulnerable to a Broken Access Control (BAC) flaw that allows any authenticated user, regardless of their role, to activate or deactivate user accounts, including those of administrators. This could lead to unauthorized access and manipulation of user privileges within the CRM system. Organizations using NextCRM should prioritize upgrading to version 0.12.0 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the `admin` role. Consequently, any authenticated user (even those with the lowest `member` or `viewer` roles) can arbitrarily activate or deactivate any user account in the system, including the main administrator. Version 0.12.0 fixes the issue.