CVE-2026-108704

CordysCRM through version 1.9.3 is affected by an authorization bypass vulnerability (CWE-639). Low-privileged authenticated users can bypass permission checks by setting the owner field to their own user ID. By sending requests to the follow/record/add endpoints, an attacker can add follow-up re...

EUVD-2026-96704

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite...