CVE-2026-55550High 7.1NextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog0.2%
CVE-2026-55544High 7.6NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering0.2%
CVE-2026-47130High 7.1NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering0.2%
CVE-2026-47129High 8.1NextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts0.3%