CVE-2026-55544 Overview
CVE-2026-55544 is a broken access control vulnerability [CWE-284] affecting NextCRM, an open-source customer relationship management (CRM) application. In version 0.12.1, the Model Context Protocol (MCP) campaign tools expose campaign read and write operations over the network through user-generated Bearer API tokens prefixed with nxtc__. Multiple MCP campaign handlers query and mutate campaign objects by object ID while ignoring the authenticated user ID. A low-privileged authenticated user holding a valid MCP API token can enumerate every campaign, read campaign details, modify or delete campaigns owned by other users, alter campaign templates and steps, and trigger or pause campaign delivery. Version 0.12.2 resolves the flaw.
Critical Impact
Any authenticated NextCRM user with an MCP API token can read, modify, delete, and control campaigns belonging to other users across the tenant.
Affected Products
- NextCRM version 0.12.1
- NextCRM MCP campaign tool handlers
- Deployments issuing nxtc__ Bearer API tokens
Discovery Timeline
- 2026-07-20 - CVE-2026-55544 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-55544
Vulnerability Analysis
NextCRM implements a per-user authorization model that restricts standard users to campaigns they created. The MCP campaign handlers bypass this model. Instead of scoping database queries with both the campaign object ID and the authenticated user ID from the Bearer token session, the handlers resolve records solely by object ID. This allows any authenticated caller with a valid MCP token to reference arbitrary campaign IDs and receive full read or write access. The exposed operations include listing all campaigns, reading campaign contents, updating fields, deleting campaigns, editing templates and step definitions, and triggering delivery state changes such as start or pause.
Root Cause
The root cause is missing ownership enforcement in the MCP campaign tool handlers. The handlers accept a campaign object ID from the caller and execute database operations without a WHERE owner_id = current_user_id predicate. The authorization layer trusts token authenticity but never verifies that the token holder owns the referenced campaign. This pattern maps directly to CWE-284: Improper Access Control.
Attack Vector
Exploitation requires network access to the NextCRM instance and a valid MCP Bearer API token in the nxtc__... format. Any registered low-privileged user can generate such a token. The attacker calls MCP campaign endpoints with target campaign IDs, obtained through the list handler that enumerates campaigns across all tenants of the user pool. No user interaction from the campaign owner is required.
The vulnerability manifests in the MCP campaign handlers where object-ID-only lookups replace the expected owner-scoped queries. See the GitHub Security Advisory GHSA-c9vg-c532-ppqx for technical details.
Detection Methods for CVE-2026-55544
Indicators of Compromise
- Requests to MCP campaign endpoints carrying Bearer tokens prefixed with nxtc__ from users who do not own the referenced campaign IDs.
- Unexpected campaign enumeration activity where a single API token accesses campaign IDs spanning multiple owners.
- Unauthorized modifications to campaign templates, steps, or delivery state without a corresponding owner login session.
Detection Strategies
- Correlate MCP API access logs with campaign ownership records to flag cross-owner access patterns.
- Alert on high-volume campaign list or read operations originating from a single MCP token within a short time window.
- Baseline expected MCP campaign write operations per user and alert on deviations, particularly delete and delivery-state changes.
Monitoring Recommendations
- Enable audit logging on all MCP campaign handler invocations and retain the authenticated user ID, target campaign ID, and campaign owner ID.
- Forward NextCRM application logs and reverse-proxy access logs to a centralized log platform for cross-owner query correlation.
- Review recent campaign modification, deletion, and state-change events on any instance running version 0.12.1.
How to Mitigate CVE-2026-55544
Immediate Actions Required
- Upgrade NextCRM to version 0.12.2 or later, which enforces owner scoping in MCP campaign handlers.
- Rotate all issued nxtc__ MCP API tokens after upgrading to invalidate tokens that may have been abused.
- Audit campaign records for unauthorized modifications, deletions, or delivery-state changes performed while running 0.12.1.
Patch Information
The maintainers of NextCRM released version 0.12.2 to fix CVE-2026-55544. The patch adds authenticated-user scoping to the MCP campaign tool handlers so that campaign lookups and mutations require the caller to own the target campaign. Refer to the GitHub Security Advisory GHSA-c9vg-c532-ppqx for the fix commit and release notes.
Workarounds
- Disable the MCP campaign tools or block the associated routes at the reverse proxy until the upgrade to 0.12.2 completes.
- Revoke MCP API tokens for all non-administrative users and restrict token issuance to trusted operators.
- Restrict network access to the NextCRM MCP endpoints using IP allow-lists or authenticated VPN access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
