CVE-2026-108701: 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
1Panel-dev CordysCRMto a version that resolves this vulnerability.Fixed in 1.9.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated CordysCRM user can exploit it, including users who do not have contract update permission. The issue can be used to modify contracts belonging to other organizations.
What access and interaction are required for exploitation?
An attacker needs a valid authenticated account and network access to send a POST request to /contract/sort. No user interaction is required.
Which versions are affected?
CordysCRM versions before 1.9.2 are affected. Upgrading to 1.9.2 or later addresses the affected handler.
How can I check for attempted exploitation?
Review requests to POST /contract/sort, particularly those from accounts without contract update permission. Investigate requests containing dragNodeId, stage, and field values, especially where they resulted in changes to contracts outside the user's organization.