Pdovhomilja Nextcrm-app vulnerabilities
- pdovhomilja nextcrm-appNextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog7.1 High
- pdovhomilja nextcrm-appNextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering7.6 High
- pdovhomilja nextcrm-appNextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering7.1 High
- pdovhomilja nextcrm-appNextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts8.1 High