CVE-2026-76901

CordysCRM , an open source AI-powered CRM supporting private deployment, contains a broken object-level authorization flaw prior to version 1.7.4 . The endpoints GET /pool/lead/get/{id} (in PoolClueController.get) and GET /pool/account/get/{id} (in PoolCustomerController.get) perform bare pool-re...