Missing Authorization in 1Panel-dev CordysCRM Allows Data Exposure for Users
CVE-2026-108700

7.1HIGH

Key Information:

Vendor

1panel-dev

Status
Cordyscrm
Vendor
CVE Published:
11 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-108700?

The 1Panel-dev CordysCRM product prior to version 1.9.2 has been found to possess a missing authorization vulnerability. Authenticated users can exploit this weakness to access business titles by sending a POST request to /field/source/business-title without appropriate permission checks. This flaw allows unauthorized users lacking the CONTRACT_BUSINESS_TITLE_READ permission to access sensitive organizational data, including tax identification numbers, bank account details, opening banks, registration addresses, and phone numbers, which consequently compromises the confidentiality of the affected entities.

Affected Version(s)

CordysCRM 0 < 1.9.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-108700 - Proof of Concept

References

https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1...
exploit
https://github.com/1Panel-dev/CordysCRM/blob/a0ef69d31fd9...
technical-description
https://github.com/1Panel-dev/CordysCRM/commit/a31fa16fb2...
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yaqi Chao
.