CVE-2026-108700
Deferred Deferred - Pending Action

Missing Authorization in 1Panel-dev CordysCRM Exposes Business Data

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108700
EUVD
EUVD-2026-96708

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
1Panel-dev CordysCRM 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108700 is a missing authorization vulnerability in 1Panel-dev CordysCRM versions before 1.9.2. It allows authenticated users to list business titles by sending a POST request to /field/source/business-title without proper permission checks. Users without CONTRACT_BUSINESS_TITLE_READ permission can still access sensitive invoicing details.

Detection Guidance

To detect this vulnerability, check for unauthorized POST requests to /field/source/business-title in your CordysCRM logs. Monitor for users without CONTRACT_BUSINESS_TITLE_READ permission accessing sensitive invoicing data. Review network traffic for requests to this endpoint from authenticated users.

Impact Analysis

This vulnerability exposes sensitive organization data such as tax identification numbers, bank account details, opening banks, registration addresses, and phone numbers. Attackers with authenticated access could retrieve this information, leading to potential financial fraud or identity theft.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection regulations like GDPR and HIPAA, as it allows unauthorized access to sensitive personal and financial data. Organizations using affected versions may face regulatory penalties and reputational damage.

Mitigation Strategies

Immediately upgrade CordysCRM to version 1.9.2 or later to patch the missing authorization flaw. Review and enforce proper permission checks for the /field/source/business-title endpoint. Audit user permissions to ensure only authorized users can access CONTRACT_BUSINESS_TITLE_READ functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart