Read the docs
TI-2026-70680 Aliases CVE-2026-108700GHSA-378v-v9jq-pgrf

Missing authorization in CordysCRM exposes invoicing entity data

Priority MEDIUM 64CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization flaw (CWE-862) in POST /field/source/business-title. Authenticated users without the CONTRACT_BUSINESS_TITLE_READ permission can list business titles, which exposes tax identification numbers, bank account numbers, opening banks, registration addresses and phone numbers of organization invoicing entities. A low-privileged remote attacker needs only a valid account, and a public proof of concept is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00238 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed CordysCRM (1Panel-dev): 1.9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1Panel-devCordysCRMbefore 1.9.21.9.2Patch availableCNA
  • CordysCRM Vendor1Panel-dev Affected before 1.9.2 Fixed in 1.9.2 Patch available CNA

Remediation

Upgrade 1Panel-dev CordysCRM to version 1.9.2 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA CordysCRM (1Panel-dev) Fixed in 1.9.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    1Panel-dev CordysCRM 1.9.2

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-70672 Missing authorization in 1Panel-dev CordysCRM exposes other users' recordsPriority MEDIUM 64
    • TI-2026-70681 Missing authorization in 1Panel-dev CordysCRM lets users modify contractsPriority MEDIUM 57
    Show all 3 records →

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-108700
  2. 2026-10-11 Alias added: GHSA-378v-v9jq-pgrf
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-14 CISA SSVC decision points changed
  5. 2026-10-14 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 1

Other 1

  • TI-2023-08712 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token CVSS 3.1CRITICAL 9.8
  • TI-2023-08729 KubeOperator is vulnerable to unauthorized access to system API CVSS 3.1CRITICAL 9.8
  • TI-2026-54047 MaxKB: Prompt-injectable agent can lead to command execution CVSS 3.1CRITICAL 10.0
  • TI-2025-43180 CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface… CVSS 3.1CRITICAL 9.8
  • TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
  • TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences