CVE-2026-108703

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations ...

EUVD-2026-96705

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations ...

CVE-2026-108703

CordysCRM versions through 1.9.3 are affected by a missing authorization vulnerability (CWE-862) within the POST /approval-resource/push endpoint. The root cause is a lack of ownership checks, which allows authenticated users to submit any resource for approval by supplying arbitrary resourceId v...

CVE-2026-108703 CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations ...

CVE-2026-108703: Missing Authorization

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations ...

PT-2026-109994

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations ...