Read the docs
TI-2026-45288 Aliases CVE-2026-63647

CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

Priority HIGH 81CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00496 42nd percentileScored 2026-11-07
Fix Fixed CordysCRM (1Panel-dev): 1.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1Panel-devCordysCRMbefore 1.7.21.7.2Patch availableCNA
  • CordysCRM Vendor1Panel-dev Affected before 1.7.2 Fixed in 1.7.2 Patch available CNA

Remediation

  • Fix · CNA CordysCRM (1Panel-dev) Fixed in 1.7.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63647

References

Other 4

  • TI-2023-08712 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token CVSS 3.1CRITICAL 9.8
  • TI-2023-08729 KubeOperator is vulnerable to unauthorized access to system API CVSS 3.1CRITICAL 9.8
  • TI-2026-54047 MaxKB: Prompt-injectable agent can lead to command execution CVSS 3.1CRITICAL 10.0
  • TI-2025-43180 CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface… CVSS 3.1CRITICAL 9.8
  • TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
  • TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences