CVE-2026-47130

{
  "id": "CVE-2026-47130",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T21:16:47.917",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the specific resource being modified. This allows any authenticated user (even with a standard `member` role) to arbitrarily modify sensitive CRM contacts and targets belonging to other users or organizations (cross-tenant data tampering). Version 0.12.0 fixes the issue."
    },
    {
      "lang": "es",
      "value": "NextCRM es un software de gestión de relaciones con clientes (CRM) de código abierto. En las versiones anteriores a la 0.12.0 existe una vulnerabilidad de Autorización a Nivel de Objeto Rota (BOLA/IDOR) en los puntos finales de actualización de contactos y objetivos del CRM. La aplicación no verifica si el usuario autenticado tiene la propiedad del recurso específico que se está modificando. Esto permite a cualquier usuario autenticado (incluso con un rol estándar ’member’) modificar arbitrariamente contactos y objetivos sensibles del CRM pertenecientes a otros usuarios u organizaciones (manipulación de datos entre inquilinos). La versión 0.12.0 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "pdovhomilja",
          "product": "nextcrm-app",
          "versions": [
            {
              "version": "< 0.12.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-21T16:31:46.125999Z",
          "id": "CVE-2026-47130",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-mg5f-m89f-4gmc",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-mg5f-m89f-4gmc",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}