CVE-2026-47129

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-47129

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47129.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-47129

Aliases

GHSA-gm7p-f88p-vhfr

Published

2026-07-20T20:34:55.578Z

Modified

2026-07-24T03:57:06.130870956Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts

Details

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the activateUser and deactivateUser Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the admin role. Consequently, any authenticated user (even those with the lowest member or viewer roles) can arbitrarily activate or deactivate any user account in the system, including the main administrator. Version 0.12.0 fixes the issue.

Database specific

{
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47129.json"
}

References

Affected packages

Git / github.com/pdovhomilja/nextcrm-app

Affected ranges

Type

GIT

Repo

https://github.com/pdovhomilja/nextcrm-app

Events

Introduced

Fixed

0d7457b28b142b393613042bf2d8e61f16d6b480

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.12.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*

v0.1.0

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.11.0

v0.11.1

v0.2.0

v0.3.0

v0.3.1

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.8.0

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47129.json"