Read the docs
TI-2026-70672 Aliases CVE-2026-108692GHSA-5qf6-4wf6-7g7c

Missing authorization in 1Panel-dev CordysCRM exposes other users' records

Priority MEDIUM 64CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 has a missing authorization flaw (CWE-862) in eight ModuleFieldController /field/source data-source endpoints that perform no permission checks. An authenticated user who is denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00238 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed CordysCRM (1Panel-dev): 1.9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1Panel-devCordysCRM1.9.0 to before 1.9.21.9.2Patch availableCNA
  • CordysCRM Vendor1Panel-dev Affected 1.9.0 to before 1.9.2 Fixed in 1.9.2 Patch available CNA

Remediation

Upgrade 1Panel-dev CordysCRM to version 1.9.2 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA CordysCRM (1Panel-dev) Fixed in 1.9.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    1Panel-dev CordysCRM 1.9.2

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-70680 Missing authorization in CordysCRM exposes invoicing entity dataPriority MEDIUM 64
    • TI-2026-70681 Missing authorization in 1Panel-dev CordysCRM lets users modify contractsPriority MEDIUM 57
    Show all 3 records →

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-108692
  2. 2026-10-11 Alias added: GHSA-5qf6-4wf6-7g7c
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-14 CISA SSVC decision points changed
  5. 2026-10-14 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 1

Other 2

  • TI-2023-08712 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token CVSS 3.1CRITICAL 9.8
  • TI-2023-08729 KubeOperator is vulnerable to unauthorized access to system API CVSS 3.1CRITICAL 9.8
  • TI-2026-54047 MaxKB: Prompt-injectable agent can lead to command execution CVSS 3.1CRITICAL 10.0
  • TI-2025-43180 CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface… CVSS 3.1CRITICAL 9.8
  • TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
  • TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences