CVE-2026-55544

{
  "id": "CVE-2026-55544",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-20T22:17:16.407",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens (`nxtc__...`). The application has an authorization model that restricts normal users to campaigns they created, but multiple MCP campaign handlers ignore the authenticated user ID and query or mutate campaigns only by object ID. As a result, a low-privileged authenticated user with a valid MCP API token can enumerate all campaigns, read campaign details, update or delete campaigns owned by other users, modify campaign templates and steps, and potentially trigger or pause campaign delivery. Version 0.12.2 fixes the issue."
    },
    {
      "lang": "es",
      "value": "NextCRM es software de gestión de relaciones con el cliente (CRM) de código abierto. En la versión 0.12.1, las herramientas de campaña de MCP exponen operaciones de lectura y escritura de campañas a través de la red utilizando tokens API Bearer generados por el usuario (’nxtc__...’). La aplicación tiene un modelo de autorización que restringe a los usuarios normales a las campañas que crearon, pero múltiples manejadores de campañas de MCP ignoran el ID de usuario autenticado y consultan o mutan campañas solo por ID de objeto. Como resultado, un usuario autenticado con bajos privilegios y un token API de MCP válido puede enumerar todas las campañas, leer detalles de campañas, actualizar o eliminar campañas propiedad de otros usuarios, modificar plantillas y pasos de campañas, y potencialmente activar o pausar la entrega de campañas. La versión 0.12.2 corrige el problema."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "pdovhomilja",
          "product": "nextcrm-app",
          "versions": [
            {
              "version": "= 0.12.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T13:49:36.116703Z",
          "id": "CVE-2026-55544",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-c9vg-c532-ppqx",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pdovhomilja/nextcrm-app/security/advisories/GHSA-c9vg-c532-ppqx",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}