CVE-2026-108701

1Panel-dev CordysCRM versions before 1.9.2 are vulnerable to a missing authorization flaw in the ContractController sortModule handler. The POST /contract/sort endpoint lacks necessary permission annotations, allowing authenticated users without contract update privileges to modify any contract b...

EUVD-2026-96707

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to...