Get real-time updates on Telegram
CVE-2026-55544: nextcrm-app = 0.12.1
CVE-2026-55544. CVSS 3.1 base score 7.6 (HIGH, Vendor/CNA). EPSS 0.00314 (percentile 0.23118), scored 24-Oct-2026.
Affected technology
nextcrm-app · = 0.12.1
pdovhomilja
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
A low-privileged authenticated user with a valid MCP API token can enumerate all campaigns, read campaign details, update or delete campaigns owned by other users, modify campaign templates and steps, and potentially trigger or pause campaign delivery. Vendor/CNA’s CVSS 3.1 assessment (base score 7.6/10) rates confidentiality and availability impact as low; integrity impact as high.
- CWE
- CWE-284, CWE-639, CWE-862
- CCR priority
- 30.5 /100 (P4)
- CVSS 3.1
- 7.6 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L · Vendor/CNA
- EPSS
- 0.00314 · percentile 0.23118 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-55544.html