NextCRM MCP Server Missing Authorization on Product Catalog Write Operations
First seen Jul 21, 2026 · Updated Jul 21, 2026 · CVSS 7.1
NextCRM's MCP server exposes product catalog management tools (create, update, archive, delete) without enforcing the same role-based restrictions applied to the normal web application. Any authenticated low-privileged user who can obtain an MCP Bearer token can tamper with the shared CRM product catalog, an action normally reserved for managers and admins. This is a broken access control flaw surfaced through an agent-facing tool interface, not a novel AI-specific attack.
Technical Analysis
The MCP tool layer at /api/mcp/mcp reimplements product CRUD operations but fails to replicate the manager/admin role check present in the standard application server actions, creating a parallel, under-protected privilege path. An attacker only needs a valid low-privileged user session capable of generating an MCP API token; no prompt injection, model manipulation, or agent compromise is required. The entry point is the MCP tool invocation itself, which an AI agent (or a user directly calling the MCP API) can use to write to organization-wide business data. This crosses the boundary between the LLM/agent tool-calling layer and backend authorization logic, illustrating a class of MCP integration risk where tool endpoints bypass application-layer access controls.
Affected Systems
NextCRM; protocols: MCP
Detection Signatures
- Requests to /api/mcp/mcp performing product create/update/delete/archive actions from Bearer tokens tied to non-manager/non-admin user roles
- MCP token generation events followed by product-mutation API calls without a corresponding manager/admin role claim in session context
- Audit log entries showing product catalog changes attributed to users lacking manager/admin roles
- Anomalous volume of product soft-deletes or archives correlated with low-privilege token usage
Remediation Steps
- 1
Upgrade NextCRM
Update to version 0.12.3 or later, which enforces role checks on MCP product tool endpoints.
- 2
Enforce consistent authorization
Ensure all MCP/agent-facing tool endpoints call the same role/permission validation logic used by standard application server actions rather than reimplementing separate authorization paths.
- 3
Audit MCP token scopes
Review MCP Bearer token issuance to ensure tokens inherit and enforce the underlying user's role and permission scope, and restrict token generation for sensitive write operations.
- 4
Monitor tool-layer writes
Add logging and alerting on product catalog mutations originating from MCP tool calls, flagging any performed by non-privileged accounts.
- 5
Conduct MCP endpoint access review
Audit all other MCP-exposed tools/endpoints in NextCRM for similar missing role checks, since this pattern may recur across other business objects.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.