CVE-2026-108700: 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated CordysCRM user who can send a POST request to /field/source/business-title can exploit it, including users who do not have the CONTRACT_BUSINESS_TITLE_READ permission.
What information could be exposed?
The endpoint can disclose organization invoicing entities and associated sensitive business data, including tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.
Which versions are affected?
CordysCRM versions before 1.9.2 are affected.
How can I determine whether my deployment is exposed?
Check whether the deployed CordysCRM version is earlier than 1.9.2. In an affected version, test whether a low-privileged authenticated account lacking CONTRACT_BUSINESS_TITLE_READ can successfully POST to /field/source/business-title and receive business-title data.