CVE-2026-108704: CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite followtime and follower on any known customer, clue or opportunity.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated CordysCRM account with low privileges. The vulnerable functionality is reachable over the network, and no user interaction is required.
What access or information does an attacker need beyond an account?
The attacker must know the target customer, clue, or opportunity to send requests to the follow/record/add endpoints. They set the owner field to their own user ID to bypass the intended permission checks.
What can an attacker change?
An attacker can add follow-up records on a known customer, clue, or opportunity and overwrite the follow_time and follower fields. The provided data indicates integrity impact only; it does not indicate confidentiality or availability impact.
Which versions are identified as affected?
CordysCRM through version 1.9.3 is identified as affected.