Authenticated Data Import Vulnerability in CordysCRM

Executive Summary

CVE-2026-108705 is a missing authorization vulnerability in CordysCRM through version 1.9.3. It affects the POST /custom-form/data/import endpoint, allowing authenticated users to import data into any custom form by specifying a customFormId. Attackers with low privileges can upload Excel files with importType ADD or UPDATE to create new records or overwrite existing ones in forms they do not manage.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized POST requests to /custom-form/data/import with customFormId parameters. Monitor for unexpected Excel file uploads or data modifications in custom forms. Review logs for low-privileged users accessing or altering forms they shouldn't manage.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to create or modify records in custom forms they should not access. Attackers could insert malicious data, overwrite existing records, or perform cross-tenant record takeovers by exploiting flaws in permission checks. This could lead to data corruption, integrity breaches, or unauthorized access to sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by enabling unauthorized data access, modification, or creation. GDPR requires strict data access controls and integrity, while HIPAA mandates protection against unauthorized changes to health records. Exploitation could result in data breaches, violating these regulations and potentially leading to legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest CordysCRM patch if available. Restrict access to the /custom-form/data/import endpoint. Implement strict permission checks for form data operations. Monitor and audit form data changes for suspicious activity.

Useful 0 Not Useful 0