CVE-2026-55544

NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens (`nxtc__...`). The application has an authorization model that restricts normal users to campaigns they created, but multiple MCP campaign handlers ignore the authenticated user ID and query or mutate campaigns only by object ID. As a result, a low-privileged authenticated user with a valid MCP API token can enumerate all campaigns, read campaign details, update or delete campaigns owned by other users, modify campaign templates and steps, and potentially trigger or pause campaign delivery. Version 0.12.2 fixes the issue.

• CWE-284
• CWE-639
• CWE-862

• https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-c9vg-c532-ppqx
• https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-c9vg-c532-ppqx

Published

Jul 20, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55522PraisonAI is a multi-agent teams system. In versions 3.9.26 …7.8
• CVE-2026-55523PraisonAI is a multi-agent teams system. In versions 1.5.128…7.7
• CVE-2026-55524PraisonAI is a multi-agent teams system. In versions prior t…7.5
• CVE-2026-5553A vulnerability was identified in itsourcecode Online Cellph…6.3
• CVE-2026-5554A security flaw has been discovered in code-projects Concert…7.3
• CVE-2026-55542Snipe-IT is an IT asset/license management system. Prior to …4.3
• CVE-2026-55548Yamcs is a mission control framework. Prior to 5.12.8 and 5.…4.3
• CVE-2026-5555A weakness has been identified in code-projects Concert Tick…7.3
• CVE-2026-55550NextCRM is open-source customer relationship management (CRM…7.1
• CVE-2026-55554Dompdf is an HTML to PDF converter for PHP. In versions 3.15…7.5
• CVE-2026-55555Dompdf is an HTML to PDF converter for PHP. Versions 3.15 an…7.5
• CVE-2026-5556A security vulnerability has been detected in badlogic pi-mo…6.3