CVE-2026-108705

CordysCRM through version 1.9.3 is vulnerable to a missing authorization flaw in the POST /custom-form/data/import endpoint. This vulnerability allows authenticated, low-privileged users to import data into any custom form by specifying a customFormId . Attackers can upload Excel files using impo...

CVE-2026-108703

CordysCRM versions through 1.9.3 are affected by a missing authorization vulnerability (CWE-862) within the POST /approval-resource/push endpoint. The root cause is a lack of ownership checks, which allows authenticated users to submit any resource for approval by supplying arbitrary resourceId v...

EUVD-2026-96705

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations ...

CVE-2026-108703 CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId values for contracts, invoices, quotations ...

CVE-2026-108702

CordysCRM versions through 1.9.3 are vulnerable to a Blind SSRF due to a missing PROCESS_SETTING permission check on the POST /approval-flow/webhook/test endpoint. This flaw allows any authenticated user to trigger server-side requests to arbitrary URLs. Attackers can utilize a controlled host to...

CVE-2026-108702 CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test

1Panel-dev CordysCRM through 1.9.3 lacks a PROCESSSETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe...

CVE-2026-108700

1Panel-dev CordysCRM versions before 1.9.2 are vulnerable to a missing authorization flaw (CWE-862) within the /field/source/business-title endpoint. Authenticated users can perform a POST request to this endpoint without the required CONTRACT_BUSINESS_TITLE_READ permission. Successful exploitati...

CVE-2026-108701

1Panel-dev CordysCRM versions before 1.9.2 are vulnerable to a missing authorization flaw in the ContractController sortModule handler. The POST /contract/sort endpoint lacks necessary permission annotations, allowing authenticated users without contract update privileges to modify any contract b...

CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...

EUVD-2026-96707

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to...

EUVD-2026-96708

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...

CVE-2026-108701 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to...

CVE-2026-108692

1Panel-dev CordysCRM versions 1.9.0 before 1.9.2 are vulnerable to a missing authorization vulnerability (CWE-862) within eight ModuleFieldController /field/source data-source endpoints. The root cause is a lack of proper permission checks, allowing authenticated users who are denied specific mod...

EUVD-2026-96709

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...

CVE-2026-108692 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations,...

CVE-2026-108689

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant...

EUVD-2026-96712

Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant...

CVE-2026-108688

Eladmin versions through 2.7 are vulnerable to a missing authorization flaw in the LocalStorageController uploadPicture handler. This allows low-privileged authenticated users to bypass the storage:add permission. By sending POST requests with image-named files to /api/localStorage/pictures, an a...

EUVD-2026-96713

Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to writ...

CVE-2026-108688 Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload

Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files to /api/localStorage/pictures to writ...