The vulnerability is an RBAC bypass in the MCP product tools of NextCRM. The API endpoint /api/mcp/mcp processes write operations for the product catalog without enforcing role checks, allowing any authenticated low‑privileged user who can generate an MCP API token to create, modify, archive, or soft‑delete products in the shared CRM product catalog. This flaw transforms low‑privileged users into de facto administrators of the shared product catalog, compromising the confidentiality and integrity of business data such as product listings, pricing, and inventory status. The weakness is cataloged as CWE‑269, CWE‑284, and CWE‑862, highlighting the lack of proper authorization checks.

NextCRM, the open‑source CRM platform maintained by pdovhomilja, is impacted. Version 0.12.1 contains the flaw, and version 0.12.3 includes a fix. The status of other intermediate releases, such as 0.12.2, is not specified in the available data. Administrators should verify the version of their NextCRM deployment and plan an upgrade to a fixed release accordingly.

The CVSS score of 7.1 places the vulnerability in the high category, indicating a significant potential for harm if exploited. EPSS predicts a very low probability of exploit (<1%), and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is internal: a user with the ability to generate MCP API tokens, and because authenticated access is required, an attacker would need insider knowledge or social engineering to obtain a token, but once achieved they can modify the shared product catalog with full privileges.