CVE-2026-47130
NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the specific resource being modified. This allows any authenticated user (even with a standard `member` role) to arbitrarily modify sensitive CRM contacts and targets belonging to other users or organizations (cross-tenant data tampering). Version 0.12.0 fixes the issue.
| CWE | CWE-639 |
| Vendor | pdovhomilja |
| Product | nextcrm-app |
| Published | Jul 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for pdovhomilja nextcrm-app
Be the first to know when new high vulnerabilities affecting pdovhomilja nextcrm-app are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
None
Affected Versions
pdovhomilja / nextcrm-app
< 0.12.0