PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47129 pdovhomilja CVE debrief

CVE-2026-47129 is a high-severity vulnerability in NextCRM, an open-source customer relationship management software. Versions prior to 0.12.0 are affected by a Broken Access Control (BAC) vulnerability in the `activateUser` and `deactivateUser` Next.js Server Actions. This vulnerability allows any authenticated user, including those with the lowest `member` or `viewer` roles, to arbitrarily activate or deactivate any user account in the system, including the main administrator.

Vendor
pdovhomilja
Product
nextcrm-app
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-22
Advisory published
2026-07-20
Advisory updated
2026-07-22

Who should care

Organizations using NextCRM versions prior to 0.12.0 should prioritize patching this vulnerability to prevent potential exploitation. Security teams and administrators responsible for managing user accounts and access control in NextCRM deployments should be aware of this issue and take immediate action to mitigate the risk.

Technical summary

The vulnerability exists in the `activateUser` and `deactivateUser` Next.js Server Actions of NextCRM. The application fails to verify if the requesting user holds the `admin` role, allowing any authenticated user to perform these actions. This can lead to unauthorized elevation of privileges or disruption of user accounts. The vulnerability is addressed in version 0.12.0 of NextCRM. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance. Vendor-supported updates or mitigations should be planned through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified.

Defensive priority

High

Recommended defensive actions

  • Patch NextCRM to version 0.12.0 or later
  • Review and restrict access to user account management features
  • Monitor user account activations and deactivations for suspicious activity
  • Implement additional access controls and role-based restrictions
  • Verify user roles and permissions for critical actions

Evidence notes

The CVE record was published on 2026-07-20T21:16:47.777Z and was last modified on 2026-07-22T20:50:36.493Z. The NVD entry is currently Deferred. The vulnerability is described in the CVE record and additional details are provided in the source references.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47129 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47129

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47129 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47129

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.