CVE-2026-108704
Deferred Deferred - Pending Action

Authorization Bypass in CordysCRM Allows Privilege Escalation

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite follow_time and follower on any known customer, clue or opportunity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108704
EUVD
EUVD-2026-96704

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
1Panel-dev CordysCRM 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108704 is an authorization bypass vulnerability in CordysCRM versions up to 1.9.3. Low-privileged authenticated users can manipulate the owner field in requests to endpoints like follow/record/add to bypass permission checks. This allows overwriting fields such as follow_time and follower on any customer, clue, or opportunity records.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the endpoints /account/follow/record/add, /follow/record/add, or /lead/follow/record/add. Check if requests include a self-declared owner field that bypasses permission checks. Use a proof-of-concept script like the one in Resource 3 to test if unauthorized follow-up records can be created.

Impact Analysis

An attacker could gain unauthorized access to sensitive CRM data by modifying follow-up records. This includes altering timestamps and ownership details on customer, clue, or opportunity records, potentially leading to data corruption or unauthorized actions within the system.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating compliance requirements for data integrity and access control. GDPR and HIPAA mandate strict access controls and audit trails; exploitation may result in non-compliance, potential data breaches, and regulatory penalties.

Mitigation Strategies

Immediately update CordysCRM to a patched version beyond 1.9.3. If an update is not available, restrict access to the vulnerable endpoints by implementing stricter permission checks in BaseFollowUpService.java and related controllers. Review and block any requests with manipulated owner fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108704. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart