CVE-2026-55550

NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However, in version 0.12.1, the MCP product tools expose the same write operations through `/api/mcp/mcp` using user-generated Bearer tokens and do not enforce role checks. Any authenticated low-privileged user who can generate an MCP API token can create, modify, archive, or soft-delete products in the shared CRM product catalog. Version 0.12.3 contains a fix.

• CWE-269
• CWE-284
• CWE-862

• https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58
• https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-wv63-cq38-qg58

Published

Jul 20, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5553A vulnerability was identified in itsourcecode Online Cellph…6.3
• CVE-2026-5554A security flaw has been discovered in code-projects Concert…7.3
• CVE-2026-55542Snipe-IT is an IT asset/license management system. Prior to …4.3
• CVE-2026-55544NextCRM is open-source customer relationship management (CRM…7.6
• CVE-2026-55548Yamcs is a mission control framework. Prior to 5.12.8 and 5.…4.3
• CVE-2026-5555A weakness has been identified in code-projects Concert Tick…7.3
• CVE-2026-55554Dompdf is an HTML to PDF converter for PHP. In versions 3.15…7.5
• CVE-2026-55555Dompdf is an HTML to PDF converter for PHP. Versions 3.15 an…7.5
• CVE-2026-5556A security vulnerability has been detected in badlogic pi-mo…6.3
• CVE-2026-55568Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in…5.9
• CVE-2026-5557A vulnerability was detected in badlogic pi-mono up to 0.58.…6.3
• CVE-2026-55570SiYuan is an open-source personal knowledge management syste…9