CVE-2026-76901 Details
Description
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4.
A broken object-level authorization vulnerability has been identified in the CordysCRM application, specifically in the PoolClueController and PoolCustomerController. This vulnerability allows authenticated users with the 'CLUE_MANAGEMENT_POOL:READ' or 'CUSTOMER_MANAGEMENT_POOL:READ' permissions to access detailed records of leads and accounts that belong to other users, departments, or organizations. The exposed information includes sensitive contact details and custom field values. The issue arises because the affected endpoints do not properly enforce per-record data scope checks, allowing unauthorized access to confidential information.
The vulnerability has been fixed in CordysCRM version 1.7.4. Users should update to this version to address the broken object-level authorization issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/1Panel-dev/CordysCRM/commit/34c7c3e5de2585208744926007530037a4ce4da5 | [email protected] | Source CodeVendor |
| https://github.com/1Panel-dev/CordysCRM/pull/2976 | [email protected] | Issue TrackingVendor |
| https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4 | [email protected] | Release NotesVendor |
| https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-hxp2-5w5p-2grq | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 1Panel-dev CordysCRM | <= 1.7.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |