Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: 1Panel-dev CordysCRM 1.9.2 Clear all filters
TI-2026-70681 CVE-2026-108701 · GHSA-p6fp-39mj-m4hm

Missing authorization in 1Panel-dev CordysCRM lets users modify contracts

Priority MEDIUM 57

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00196 Published 2026-10-11 Fixed in 1.9.2 CWE-862
TI-2026-70680 CVE-2026-108700 · GHSA-378v-v9jq-pgrf

Missing authorization in CordysCRM exposes invoicing entity data

Priority MEDIUM 64

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00238 Published 2026-10-11 Fixed in 1.9.2 CWE-862
TI-2026-70672 CVE-2026-108692 · GHSA-5qf6-4wf6-7g7c

Missing authorization in 1Panel-dev CordysCRM exposes other users' records

Priority MEDIUM 64

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00238 Published 2026-10-11 Fixed in 1.9.2 CWE-862