CVE-2026-47129: NextCRM Auth Bypass Vulnerability

CVE-2026-47129 Overview

CVE-2026-47129 is a Broken Access Control [CWE-862] vulnerability in NextCRM, an open-source customer relationship management platform built on Next.js. The flaw resides in the activateUser and deactivateUser Next.js Server Actions. These actions fail to verify whether the caller holds the admin role. Any authenticated user, including those with the lowest-privilege member or viewer roles, can activate or deactivate any account in the system. This includes the primary administrator account. Version 0.12.0 remediates the issue.

Critical Impact
A low-privileged authenticated user can deactivate the primary administrator, causing a full loss of administrative access and integrity across the CRM.

Affected Products

NextCRM versions prior to 0.12.0
NextCRM activateUser Server Action
NextCRM deactivateUser Server Action

Discovery Timeline

2026-07-20 - CVE-2026-47129 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-47129

Vulnerability Analysis

NextCRM exposes user lifecycle operations through Next.js Server Actions. Server Actions are server-side functions invoked directly from client components. They must independently enforce authentication and authorization because they are directly callable by any authenticated session.

The activateUser and deactivateUser actions validate that a session exists but omit a role check. The application should restrict these operations to accounts holding the admin role. Instead, it accepts calls from any authenticated principal and applies the requested state change to the target user record.

Exploitation requires only a valid session token from a member or viewer account. An attacker can invoke deactivateUser against the primary administrator, locking the organization out of privileged functions. The same primitive supports reactivation of previously disabled or terminated accounts, enabling persistence.

Root Cause

The root cause is a missing authorization check [CWE-862] in the Server Action handlers. Session validity is treated as sufficient to authorize a privileged administrative operation. The role gate that governs the corresponding administrative UI is not mirrored on the server-side function.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user, with no user interaction required. The attacker sends a Server Action request referencing the target user identifier. The server executes the state change without evaluating the caller's role. The impact is integrity and availability loss on user account state. Confidentiality is not directly affected. See the GitHub Security Advisory GHSA-gm7p-f88p-vhfr for maintainer details.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the maintainer advisory linked above.

Detection Methods for CVE-2026-47129

Indicators of Compromise

Unexpected isActive state transitions on user records, especially targeting accounts with the admin role.
Application or database audit entries showing user activation or deactivation events initiated by non-admin principals.
Administrators reporting an inability to sign in following successful authentication of lower-privileged users.

Detection Strategies

Instrument the activateUser and deactivateUser Server Actions to log the caller's user ID, role, and target user ID for every invocation.
Alert when a Server Action modifying user state is invoked by a principal whose role is not admin.
Query the database for rows in the users table where isActive changed within a window preceding administrator lockout reports.

Monitoring Recommendations

Forward NextCRM application logs and Next.js server logs to a centralized logging platform for correlation.
Baseline the volume and source of user-management Server Action calls, and alert on deviations.
Monitor authentication failures for admin accounts as a downstream signal of unauthorized deactivation.

How to Mitigate CVE-2026-47129

Immediate Actions Required

Upgrade NextCRM to version 0.12.0 or later, which introduces the required role verification in the affected Server Actions.
Audit the users table for unauthorized activation or deactivation events since deployment and restore correct state.
Rotate session secrets and invalidate active sessions to force re-authentication after patching.

Patch Information

The maintainer released the fix in NextCRM v0.12.0. The patch adds an admin role check to the activateUser and deactivateUser Server Actions. Deployments on any earlier version remain vulnerable.

Workarounds

If immediate upgrade is not possible, restrict access to the NextCRM instance to trusted users only using network-level controls or an authenticating reverse proxy.
Temporarily remove or disable the activateUser and deactivateUser Server Action files and manage user state directly in the database until the upgrade is applied.
Reduce the number of accounts with member or viewer roles to the minimum required, limiting the exploitable population.

bash

# Upgrade NextCRM to the patched release
git fetch --tags
git checkout v0.12.0
pnpm install
pnpm build
pnpm start