A bug in NextCRM allows an authenticated user, even with a standard member role, to alter any contact or target records belonging to other users or organizations. The application does not verify resource ownership before update operations, enabling an attacker to change sensitive CRM data across tenants. This flaw aligns with CWE‑639, exposing data integrity and confidentiality across multiple customers.

Users of the open‑source NextCRM platform using versions earlier than 0.12.0 are affected. The vulnerability resides in the PATCH /api/crm/contacts/[id] endpoint and its associated target update functionality within the NextCRM codebase. All tenants and organizations that rely on the unpatched application are at risk.

The CVSS score of 7.1 indicates a high severity level, while an EPSS score of less than 1% suggests that exploitation is unlikely to be widespread at present. The flaw is not listed in the CISA KEV catalog. Attacks require only authentication to the application; any authenticated session can exploit the issue, making this a broad threat across all users with access rights. The vulnerability’s impact is limited to data tampering and does not extend to code execution or system compromise.