CVE-2026-55550

NextCRM is affected by an RBAC bypass in the MCP product tools. In version 0.12.1, write operations for the product catalog were exposed via /api/mcp/mcp using user-generated Bearer tokens without proper role checks, allowing any authenticated low-privileged user to create, modify, archive, or so...

CVE-2025-11290 CRMEB JWT HMAC Secret hard-coded key

A vulnerability was identified in CRMEB up to 5.6.1. This affects an unknown function of the component JWT HMAC Secret Handler. Such manipulation of the argument secret with the input default leads to use of hard-coded cryptographic key . It is possible to launch the attack remotely. Attacks of...

CVE-2025-11288 CRMEB GET Parameter product sql injection

A security flaw has been discovered in CRMEB up to 5.6. This issue affects some unknown processing of the file /adminapi/product/product of the component GET Parameter Handler. Performing a manipulation of the argument cateid results in sql injection. Remote exploitation of the attack is possible...