CVE-2026-63647: CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEMHEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CordysCRM SseController SSE Notification Stream Hijackto a version that resolves this vulnerability.Fixed in 1.7.2
Event History
Frequently Asked Questions
Which deployments are exposed?
CordysCRM deployments running versions earlier than 1.7.2 are exposed. The affected SSE endpoints are publicly accessible, so private deployment alone does not prevent exploitation if an attacker can reach the application.
What does an attacker need to exploit this issue?
No authentication is required. An attacker can call the SSE endpoints with a caller-controlled userId to subscribe to another user's event stream, inject SYSTEM_HEARTBEAT messages, or close that user's channel.
How can I tell whether my instance may be affected?
Instances earlier than 1.7.2 should be treated as affected. The vulnerable behavior is the public availability of /sse/subscribe, /sse/broadcast, and /sse/close combined with accepting userId from the request rather than deriving identity from an authenticated principal.
What should be done if patching is not immediately possible?
Restrict unauthenticated access to /sse/subscribe, /sse/broadcast, and /sse/close at the network or application layer until the instance can be updated. The available fix is CordysCRM 1.7.2.