CVE-2026-76901
MediumCVSS 5.8Summary
CordysCRM prior to 1.7.4 contains a vulnerability in the GET /pool/lead/get/{id} and GET /pool/account/get/{id} routes, which use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values.
Risk Assessment
The risk includes unauthorized access to customer and lead data, potentially leading to confidentiality and integrity breaches.
Recommendation
Upgrade CordysCRM to version 1.7.4 or later and implement data-scoped access controls (resourceId binding) for all read operations.
Other vulnerabilities in CordysCRM
See all- CVE-2026-76902Medium
CordysCRM prior to 1.7.4 contains a vulnerability in the /attachment/preview/{id} and /pic/preview/{id} routes, which are configured as anonymous and call AttachmentService.getResource without ownership, organization, or permission checks. An unauthenticated attacker who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations.
- CVE-2026-76900Medium
CordysCRM version 1.7.3 contains an SSRF vulnerability in ApprovalResourceService.sendWebHook, which reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it to HttpClientUtils without the SSRF validation. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add, and the server will request it when POST /approval-action/approve executes, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services.
- CVE-2026-76899Medium
CordysCRM versions 1.7.0 through 1.7.4 contain a SQL injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING_UPDATE can place an arbitrary database function in SortRequest.name because Spring request validation is missing and the blacklist is incomplete. Functions such as extractvalue and updatexml can expose database values through an error oracle.
- CVE-2026-63646Medium
CordysCRM prior to version 1.7.2 allows unauthenticated access to the GET /mcp/form/config/{formKey} endpoint due to ShiroFilter marking /mcp/** as anonymous and missing permission annotations. An unauthenticated caller can obtain field names, types, validation rules, and binding sources for CRM modules, enabling reconstruction of the application data model.
- CVE-2026-52745Medium
CordysCRM prior to version 1.7.0 has a time-based blind SQL injection vulnerability in the POST /account-pool/page endpoint. An authenticated caller with MODULE_SETTING:UPDATE can place a crafted sort.name value into a dynamic SQL ORDER BY expression without strict server-side validation.
- CVE-2026-63647Critical
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.
- CVE-2026-16223Medium
SSRF vulnerability in 1Panel-dev CordysCRM up to version 1.4.1 in the getSqlBotSrc function of IntegrationConfigService.java. A remote attacker can manipulate the appSecret argument, leading to HTTP requests to arbitrary internal resources.
- CVE-2026-16222Medium
A server-side request forgery (SSRF) vulnerability was found in the Third Party Endpoint component of CordysCRM up to version 1.4.1. The issue occurs in the TokenService.java file, where manipulation of the mkAddress argument allows remote attack execution. The project closed the report, stating it is not the official way to report a security vulnerability.
- CVE-2026-10567Low
A cross-site scripting vulnerability was found in CordysCRM up to version 1.4.1 in the Save function of ModuleFormService.java. Manipulation of the Description argument allows remote XSS attacks. The exploit has been publicly disclosed.
- CVE-2026-10514Low
A cross-site scripting vulnerability was found in CordysCRM up to version 1.6.2 in the file RequestParamTrimConfig.java. Remote attack is possible. Patch available in version 1.7.0.
Original NVD description (English source)
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4.