Read the docs
TI-2026-70681 Aliases CVE-2026-108701GHSA-p6fp-39mj-m4hm

Missing authorization in 1Panel-dev CordysCRM lets users modify contracts

Priority MEDIUM 57CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

1Panel-dev CordysCRM before 1.9.2 has a missing authorization flaw (CWE-862) in the ContractController sortModule handler for POST /contract/sort, which has no permission annotation. An authenticated user without contract update permission can modify any contract, including contracts in other organizations. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed CordysCRM (1Panel-dev): 1.9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1Panel-devCordysCRMbefore 1.9.21.9.2Patch availableCNA
  • CordysCRM Vendor1Panel-dev Affected before 1.9.2 Fixed in 1.9.2 Patch available CNA

Remediation

Update 1Panel-dev CordysCRM to version 1.9.2 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA CordysCRM (1Panel-dev) Fixed in 1.9.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    1Panel-dev CordysCRM 1.9.2

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2026-70680 Missing authorization in CordysCRM exposes invoicing entity dataPriority MEDIUM 64
    • TI-2026-70672 Missing authorization in 1Panel-dev CordysCRM exposes other users' recordsPriority MEDIUM 64
    Show all 3 records →

Timeline

  1. 2026-10-11 Threatist record created from CVE-2026-108701
  2. 2026-10-11 Alias added: GHSA-p6fp-39mj-m4hm
  3. 2026-10-13 CISA SSVC decision points changed
  4. 2026-10-13 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 1

Other 1

  • TI-2023-08712 KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token CVSS 3.1CRITICAL 9.8
  • TI-2023-08729 KubeOperator is vulnerable to unauthorized access to system API CVSS 3.1CRITICAL 9.8
  • TI-2026-54047 MaxKB: Prompt-injectable agent can lead to command execution CVSS 3.1CRITICAL 10.0
  • TI-2025-43180 CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface… CVSS 3.1CRITICAL 9.8
  • TI-2024-27040 Arbitrary File Read in Ansible Playbooks in Jumpserver CVSS 3.1CRITICAL 10.0
  • TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences