CVE-2026-63646

CordysCRM prior to 1.7.4 contains a vulnerability in the /attachment/preview/{id} and /pic/preview/{id} routes, which are configured as anonymous and call AttachmentService.getResource without ownership, organization, or permission checks. An unauthenticated attacker who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations.

CordysCRM prior to 1.7.4 contains a vulnerability in the GET /pool/lead/get/{id} and GET /pool/account/get/{id} routes, which use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values.

CordysCRM version 1.7.3 contains an SSRF vulnerability in ApprovalResourceService.sendWebHook, which reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it to HttpClientUtils without the SSRF validation. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add, and the server will request it when POST /approval-action/approve executes, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services.

CordysCRM versions 1.7.0 through 1.7.4 contain a SQL injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING_UPDATE can place an arbitrary database function in SortRequest.name because Spring request validation is missing and the blacklist is incomplete. Functions such as extractvalue and updatexml can expose database values through an error oracle.

CordysCRM prior to version 1.7.0 has a time-based blind SQL injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING:UPDATE can place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation.

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.

SSRF vulnerability in 1Panel-dev CordysCRM up to version 1.4.1 in the getSqlBotSrc function of IntegrationConfigService.java. A remote attacker can manipulate the appSecret argument, leading to HTTP requests to arbitrary internal resources.

A server-side request forgery (SSRF) vulnerability was found in the Third Party Endpoint component of CordysCRM up to version 1.4.1. The issue occurs in the TokenService.java file, where manipulation of the mkAddress argument allows remote attack execution. The project closed the report, stating it is not the official way to report a security vulnerability.

A cross-site scripting vulnerability was found in CordysCRM up to version 1.4.1 in the Save function of ModuleFormService.java. Manipulation of the Description argument allows remote XSS attacks. The exploit has been publicly disclosed.

A cross-site scripting vulnerability was found in CordysCRM up to version 1.6.2 in the file RequestParamTrimConfig.java. Remote attack is possible. Patch available in version 1.7.0.