CVE-2026-55550: NextCRM Auth Bypass Vulnerability

CVE-2026-55550 Overview

CVE-2026-55550 is a broken access control vulnerability in NextCRM, an open-source customer relationship management (CRM) application. In version 0.12.1, the Model Context Protocol (MCP) product tools exposed at /api/mcp/mcp accept user-generated Bearer tokens but fail to enforce role checks. Standard application server actions restrict product create, update, and delete operations to manager and admin roles. The MCP endpoint bypasses these controls entirely. Any authenticated low-privileged user who can mint an MCP API token can create, modify, archive, or soft-delete entries in the shared CRM product catalog. The flaw is tracked as improper privilege management [CWE-269]. Version 0.12.3 contains the fix.

Critical Impact
Low-privileged authenticated users can tamper with the organization-wide product catalog, corrupting shared business data used across the CRM.

Affected Products

NextCRM version 0.12.1
NextCRM versions prior to 0.12.3
Deployments exposing the /api/mcp/mcp MCP tool endpoint

Discovery Timeline

2026-07-20 - CVE-2026-55550 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-55550

Vulnerability Analysis

NextCRM enforces role-based access control at the application server layer. Product create, update, archive, and delete operations require the caller to hold the manager or admin role. This design keeps the shared product catalog protected from tampering by ordinary users.

Version 0.12.1 introduced a Model Context Protocol interface at /api/mcp/mcp to expose CRM operations to AI agents and automation clients. The MCP product tools re-implement the same write operations but authenticate callers using user-generated Bearer tokens without performing the corresponding role check. Any authenticated user account, regardless of role, can generate an MCP token and invoke the privileged product tools.

The resulting confused-deputy condition allows a low-privileged user to create fraudulent products, modify prices or SKUs, archive live catalog entries, or soft-delete records referenced by orders and quotes. Because the product catalog is an organization-wide business object, a single abusive account can disrupt sales workflows across the tenant.

Root Cause

The root cause is a missing authorization check in the MCP tool handler. Authentication verifies that the Bearer token maps to a valid user, but the handler omits the role gate present in the equivalent server actions. This is a classic instance of [CWE-269] Improper Privilege Management, where two code paths to the same resource enforce inconsistent authorization policies.

Attack Vector

Exploitation requires network access to the NextCRM instance and valid credentials for any authenticated account. The attacker generates an MCP API token from their user profile, then issues tool invocations against /api/mcp/mcp targeting the product create, update, or delete operations. No user interaction is required, and the requests appear as legitimate MCP traffic in application logs.

Refer to the GitHub Security Advisory GHSA-wv63-cq38-qg58 for the maintainer's technical description.

Detection Methods for CVE-2026-55550

Indicators of Compromise

Requests to /api/mcp/mcp originating from Bearer tokens tied to user accounts that do not hold the manager or admin role.
Unexpected create, update, archive, or soft-delete events in the product catalog audit trail attributed to standard users.
Newly issued MCP API tokens on accounts that historically do not use automation or AI integrations.

Detection Strategies

Correlate MCP tool invocations with the invoking user's role and alert on privileged product operations from non-privileged accounts.
Compare product mutation events across the standard server action path and the MCP path to surface authorization inconsistencies.
Baseline normal MCP token issuance rates per tenant and flag sudden increases.

Monitoring Recommendations

Enable verbose logging on /api/mcp/mcp including caller identity, role, tool name, and target object identifier.
Forward product catalog change events to a centralized log platform for retention and query.
Review MCP token inventory regularly and revoke tokens that are not tied to an approved integration.

How to Mitigate CVE-2026-55550

Immediate Actions Required

Upgrade NextCRM to version 0.12.3 or later, which contains the fix for the MCP authorization gap.
Audit the product catalog for unauthorized creations, modifications, archives, and soft-deletions performed since MCP was enabled.
Revoke all outstanding MCP API tokens and reissue them only to accounts with an approved business need.

Patch Information

The maintainer published the fix in NextCRM version 0.12.3. The corrected MCP tool handlers now apply the same manager and admin role checks enforced by the standard server actions. See the GitHub Security Advisory GHSA-wv63-cq38-qg58 for release details.

Workarounds

Restrict network access to /api/mcp/mcp at a reverse proxy or web application firewall until the upgrade is applied.
Disable MCP token generation for non-privileged users through identity provider or application configuration where supported.
Restore any tampered product records from backups and reconcile against downstream systems such as invoicing and order management.

bash

# Configuration example: block the MCP endpoint at an nginx reverse proxy
location /api/mcp/mcp {
    allow 10.0.0.0/8;   # allow trusted automation subnet only
    deny all;
    proxy_pass http://nextcrm_upstream;
}