Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the `admin` role. Consequently, any authenticated user (even those with the lowest `member` or `viewer` roles) can arbitrarily activate or deactivate any user account in the system, including the main administrator. Version 0.12.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-47129 NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activateUser… https://www.cve.org/CVERecord?id=CVE-2026-47129
Post summary
The passage announces CVE‑2026‑47129 in NextCRM, highlighting a Broken Access Control flaw in the activateUser function without any mention of exploitation activity or mitigations.
🚨*CVE* CVE-2026-47129 NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activateUser… https://www.cve.org/CVERecord?id=CVE-2026-47129 ----- Traducción: CVE-2026-47129 Nex… http://infoflow.cloud`
Post summary
The message announces the discovery of CVE-2026-47129 in NextCRM, describing a broken access control flaw in releases before 0.12.0, and links to the CVE record without providing any PoC, exploit, or patch details.