CVE-2026-108705: CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records in, or overwrite existing records of, custom forms they cannot manage.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated CordysCRM user, including a low-privileged user, can exploit it. The attacker needs the customFormId of a target custom form and access to the POST /custom-form/data/import endpoint.
What actions can an attacker perform through the vulnerable endpoint?
An attacker can upload an Excel file using importType ADD to create records in a custom form they are not permitted to manage. Using importType UPDATE, they can overwrite existing records in such forms.
Are unauthenticated deployments affected?
The described attack requires authentication, so an unauthenticated attacker cannot exploit this issue directly. However, any account with low privileges may be sufficient.
How can I determine whether my deployment is vulnerable?
CordysCRM versions through 1.9.3 are affected. Review whether authenticated low-privileged users can submit Excel imports to POST /custom-form/data/import with arbitrary customFormId values and ADD or UPDATE import types.