NextCRM contains a broken access control flaw that allows any authenticated user, even those with the lowest access levels, to activate or deactivate any user account in the system. This includes the ability to disable the main administrator account, which can lead to denial of administrative service and potentially facilitate impersonation of other users. The underlying weakness is a missing authorization check on the server-side activateUser and deactivateUser actions, corresponding to CWE-862.

The vulnerability affects the NextCRM open-source customer relationship management application distributed by pdovhomilja. All versions prior to 0.12.0 are impacted; version 0.12.0 and later include the fix.

With a CVSS score of 8.1, the flaw is considered high severity. However, its EPSS score is currently below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating low currently observed exploitation activity. The attack vector requires that the attacker is already authenticated to the application, and the attacker can then exploit the missing role check to trigger arbitrary account state changes.