CVE-2026-76902

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/id and /pic/preview/id as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key...

CVE-2026-76902 CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/id and /pic/preview/id as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key...

CVE-2026-76902

CordysCRM is an open-source AI-powered CRM supporting private deployment. In versions prior to 1.7.4 , the ShiroFilter routes /attachment/preview/{id} and /pic/preview/{id} are configured as anonymous , and both call AttachmentService.getResource, which performs a bare primary-key lookup without ...

CVE-2026-76902 CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/id and /pic/preview/id as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key...

CVE-2026-76902: Missing Authentication for Critical Function

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/id and /pic/preview/id as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key...

(0Day) Borland StarTeam Web Server AttachmentService performCheckoutFile Remote Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Borland StarTeam. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AttachmentService servlet in the FILECHECKOUT operation. The performCheckoutFile...