Authorization Bypass in 1Panel-dev CordysCRM Allows Unauthorized Access to User Contacts

CVE-2026-126496

What is CVE-2026-126496?

The CordysCRM software by 1Panel-dev prior to version 1.9.6 is susceptible to an authorization bypass vulnerability. This issue resides in the CustomerContactController.get endpoint, which fails to enforce proper authorization checks. Authenticated users can exploit this flaw to access the contacts of other users without the necessary permissions. By sending a GET request to /account/contact/get/{id} with any valid contact ID, attackers can retrieve sensitive information, including names, phone numbers, and linked customer details, potentially leading to unauthorized data exposure.

References