CyberRota Analysis
AI-GeneratedNextCRM version 0.12.1 is vulnerable due to improper role-based access control in its MCP product tools, allowing authenticated low-privileged users to perform write operations on the product catalog without appropriate restrictions. This flaw can lead to unauthorized creation, modification, or deletion of products, potentially compromising the integrity of the CRM system. Organizations using this version should prioritize upgrading to version 0.12.3 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However, in version 0.12.1, the MCP product tools expose the same write operations through `/api/mcp/mcp` using user-generated Bearer tokens and do not enforce role checks. Any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. Version 0.12.3 contains a fix.