VulnSocial

CVE-2026-55544Disclosure

LOWCVSS 7.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens (`nxtc__...`). The application has an authorization model that restricts normal users to campaigns they created, but multiple MCP campaign handlers ignore the authenticated user ID and query or mutate campaigns only by object ID. As a result, a low-privileged authenticated user with a valid MCP API token can enumerate all campaigns, read campaign details, update or delete campaigns owned by other users, modify campaign templates and steps, and potentially trigger or pause campaign delivery. Version 0.12.2 fixes the issue.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-284CWE-639CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-20); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-20: 2Mentions · 2026-07-21: 1Technical Details · 2026-07-20: 207-2007-21
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-202
Disclosure2
2026-07-211
General1
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-55544 Broken Authorization in NextCRM 0.12.1 MCP Campaign Tools https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-55544

    Post summary

    The text references CVE‑2026‑55544 as a broken authorization flaw in NextCRM 0.12.1 but provides no technical, exploit, or mitigation details.

    0000078
    4.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-55544 NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the n… https://www.cve.org/CVERecord?id=CVE-2026-55544 ----- Traducción: CVE-2026-55544 Nex… http://infoflow.cloud`

    Post summary

    The post announces CVE-2026-55544 for NextCRM 0.12.1, noting exposed campaign read/write operations, but offers no PoC, exploit code, or patch information.

    0000028
    93 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-55544 NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the n… https://www.cve.org/CVERecord?id=CVE-2026-55544

    Post summary

    CVE-2026-55544 discloses an information‑exposure issue in NextCRM's MCP campaign tools that permits remote read/write operations.

    00000672
    57.8K followersView on X

Explore more

Back to dashboard