CVE-2026-126496

1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read...

EUVD-2026-123061

1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read...

CVE-2026-126496 1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id}

1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read...

CVE-2026-126496 1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id}

1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read...

CVE-2026-126496

1Panel-dev CordysCRM versions prior to 1.9.6 are vulnerable to an authorization bypass in the CustomerContactController.get function. The vulnerability exists because the application fails to perform necessary organization, owner, or data-scope checks. This allows authenticated users with basic c...

PT-2026-144915

1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read...

CVE-2026-126496: 1Panel-dev CordysCRM: 1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that…

1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read...