PatchSiren cyber security CVE debrief
CVE-2026-47129 pdovhomilja CVE debrief
CVE-2026-47129 is a high-severity vulnerability in NextCRM, an open-source customer relationship management software. Versions prior to 0.12.0 are affected by a Broken Access Control (BAC) vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions. This vulnerability allows any authenticated user, including those with the lowest `member` or `viewer` roles, to arbitrarily activate or deactivate any user account in the system, including the main administrator.
- Vendor
- pdovhomilja
- Product
- nextcrm-app
- CVSS
- HIGH 8.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-22
Who should care
Organizations using NextCRM versions prior to 0.12.0 should prioritize patching this vulnerability to prevent potential exploitation. Security teams and administrators responsible for managing user accounts and access control in NextCRM deployments should be aware of this issue and take immediate action to mitigate the risk.
Technical summary
The vulnerability exists in the `activateUser` and `deactivateUser` Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the `admin` role, allowing any authenticated user to perform these actions. This can lead to unauthorized elevation of privileges or disruption of user accounts. The vulnerability is addressed in version 0.12.0 of NextCRM. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified.
Defensive priority
High
Recommended defensive actions
- Patch NextCRM to version 0.12.0 or later
- Review and restrict access to user account management features
- Monitor user account activations and deactivations for suspicious activity
- Implement additional access controls and role-based restrictions
- Verify user roles and permissions for critical actions
Evidence notes
The CVE record was published on 2026-07-20T21:16:47.777Z and was last modified on 2026-07-22T20:50:36.493Z. The NVD entry is currently Deferred. The vulnerability is described in the CVE record and additional details are provided in the source references.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T21:16:47.777Z and has not been modified since then. The NVD entry is currently Deferred.