CVE-2026-76902

CordysCRM is an open-source AI-powered CRM supporting private deployment. In versions prior to 1.7.4 , the ShiroFilter routes /attachment/preview/{id} and /pic/preview/{id} are configured as anonymous , and both call AttachmentService.getResource, which performs a bare primary-key lookup without ...