Advisories · Technology
pdovhomilja nextcrm-app.
Every CVE that names pdovhomilja nextcrm-app among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
NextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog
- pdovhomilja nextcrm-app
- Privilege escalation
- Broken access control
- CVSS 7.6 High
NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering
- pdovhomilja nextcrm-app
- Broken access control
- CVSS 7.1 High
NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering
- pdovhomilja nextcrm-app
- Broken access control
- CVSS 8.1 High
NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts
- pdovhomilja nextcrm-app
- Broken access control