CVE-2026-76901: CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUEMANAGEMENTPOOL:READ or CUSTOMERMANAGEMENTPOOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CordysCRMto a version that resolves this vulnerability.Fixed in 1.7.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with either the ordinary CLUE_MANAGEMENT_POOL:READ permission or CUSTOMER_MANAGEMENT_POOL:READ permission can exploit the affected endpoint. The user does not need permission for the specific lead or account they request.
What data can be exposed?
An attacker can retrieve lead or account records belonging to other users, departments, or organizations. Exposed fields can include contact names, phone numbers, owner and department attribution, and custom field values.
Which deployments are affected?
CordysCRM versions prior to 1.7.4 are affected when users have the relevant pool read permission. The vulnerable endpoints are GET /pool/lead/get/{id} and GET /pool/account/get/{id}.
How can I tell whether exploitation may have occurred?
Review requests to the affected endpoints for record IDs accessed by users whose authorized scope did not include the returned lead or account. The issue involves users supplying another record's ID to retrieve data through unscoped primary-key lookups.
What is the remediation?
Upgrade CordysCRM to version 1.7.4, which fixes the missing per-record CsPermission resourceId binding.