Missing Authorization in 1Panel-dev CordysCRM Exposes Sensitive Data

Executive Summary

CVE-2026-108692 is a missing authorization vulnerability in CordysCRM versions 1.9.0 to 1.9.1. It affects eight endpoints in the ModuleFieldController (/field/source/*). These endpoints lack proper permission checks, allowing authenticated users with denied module permissions to bypass restrictions and access sensitive data across the entire organization.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can use the provided proof-of-concept script from Resource 2. The script queries nine /field/source endpoints to check if unauthorized data access is possible. Run it with a valid session and observe if it returns data despite permission restrictions. Exit code 0 indicates the vulnerability is confirmed.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials but restricted module permissions could access confidential data such as leads, contacts, contracts, payment records, orders, and invoices owned by other users. This could lead to data breaches, unauthorized data exposure, or compliance violations depending on the data accessed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's privacy rules. Organizations using affected versions may face compliance failures, legal penalties, and reputational damage due to data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade CordysCRM to version 1.9.2 or later, as this vulnerability was fixed in that release. If upgrading is not possible, review and apply the commit a31fa16fb2dc86ab6b0fdc1ee58a204af424f38d which adds permission checks to prevent unauthorized data access.

Useful 0 Not Useful 0