CVE-2026-108700

🗓️ 11 Oct 2026 01:12:27Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 17 Views🌐 WEB

Authenticated users without CONTRACT_BUSINESS_TITLE_READ can list business titles.

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2026-108700	11 Oct 202601:53	–	circl
Cvelist	CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title	11 Oct 202601:12	–	cvelist
EUVD	EUVD-2026-96708	11 Oct 202601:12	–	euvd
NVD	CVE-2026-108700	11 Oct 202602:16	–	nvd
Positive Technologies	PT-2026-109991	11 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-108700: Missing Authorization	11 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title	11 Oct 202601:12	–	vulnrichment

Vulners

CNA

Node

fit2cloud cordys_crmRange<1.9.2

[
  {
    "vendor": "1Panel-dev",
    "product": "CordysCRM",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.9.2",
        "status": "affected",
        "versionType": "custom"
      }
    ],
    "packageURL": "pkg:github/1Panel-dev/CordysCRM",
    "repo": "https://github.com/1Panel-dev/CordysCRM"
  }
]

Source	Link
github	www.github.com/1Panel-dev/CordysCRM/blob/a0ef69d31fd98c338199579353840f34ef679197/backend/crm/src/main/java/cn/cordys/crm/system/controller/ModuleFieldController.java
vulncheck	www.vulncheck.com/advisories/1panel-dev-cordyscrm-before-1.9.2-missing-authorization-via-field-source-business-title
github	www.github.com/1Panel-dev/CordysCRM/commit/a31fa16fb2dc86ab6b0fdc1ee58a204af424f38d
github	www.github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_field_source_family.py

Parameter	Position	Path	Description	CWE
CONTRACT_BUSINESS_TITLE_READ	request body	/field/source/business-title	Authenticated users can list business titles by calling POST /field/source/business-title without the required CONTRACT_BUSINESS_TITLE_READ permission, exposing sensitive organization invoicing entities.	CWE-862

14 Oct 2026 16:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5

CVSS 47.1

EPSS0.00238

SSVC

CWE-862