CVE-2026-55550 pdovhomilja CVE debrief

Who should care

Defenders responsible for NextCRM deployments, particularly those with low-privileged users who can generate MCP API tokens, should assess exposure and apply the fix to prevent unauthorized access to the shared CRM product catalog.

Why it matters

CVE-2026-55550 is a high-severity vulnerability in NextCRM that allows low-privileged users to manipulate the shared CRM product catalog. Defenders should prioritize verifying exposure and applying the fix to prevent unauthorized access.

• Low-privileged users with MCP API tokens can create, modify, archive, or soft-delete products in the shared CRM product catalog.
• The vulnerability allows for unauthorized access to sensitive business data.
• Defenders need to verify exposure and apply the fix to prevent exploitation.
• The fix in version 0.12.3 restricts write operations to `manager` and `admin` roles.

Technical summary

The NextCRM product catalog is an organization-wide business object, and normal application server actions restrict product creation, update, and deletion to `manager` and `admin` roles. However, in version 0.12.1, the MCP product tools expose the same write operations through `/api/mcp/mcp` using user-generated Bearer tokens and do not enforce role checks. This allows low-privileged users with MCP API tokens to create, modify, archive, or soft-delete products in the shared CRM product catalog. The fix in version 0.12.3 restricts write operations to `manager` and `admin` roles.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, as low-privileged users with MCP API tokens can exploit this vulnerability.

Recommended defensive actions

• Verify if the MCP product tools are in use and if low-privileged users have generated MCP API tokens.
• Apply the fix in version 0.12.3 to restrict write operations to `manager` and `admin` roles.
• Review and update role checks for MCP product tools to prevent unauthorized access.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact requires further verification. The MCP product tools expose write operations through `/api/mcp/mcp` using user-generated Bearer tokens without enforcing role checks. Defenders should verify if low-privileged users have generated MCP API tokens and review role checks for MCP product tools. The fix in version 0.12.3 restricts write operations to `manager` and `admin` roles.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.