CVE-2026-47129

Name of the Vulnerable Software and Affected Versions NextCRM versions prior to 0.12.0

Description NextCRM contains a Broken Access Control (BAC) issue, which occurs when a system fails to properly enforce restrictions on what authenticated users are allowed to do. The application does not verify if the requesting user possesses the admin role when calling the activateUser() and deactivateUser() Next.js Server Actions. This allows any authenticated user, regardless of their role, to arbitrarily activate or deactivate any user account, including the main administrator.

Recommendations Update to version 0.12.0.