Exposed Endpoints in CordysCRM Allow Unauthorized Access to User Data

CVE-2026-63647

What is CVE-2026-63647?

CordysCRM, an open-source AI-powered customer relationship management system, has a vulnerability due to improperly secured server-sent event (SSE) endpoints. The anonymous endpoints /sse/subscribe, /sse/broadcast, and /sse/close are accessible to unauthenticated users, allowing them to interact with another user's workflow events, approval requests, and alerts. Furthermore, attackers can inject SYSTEM_HEARTBEAT messages into a user's stream or terminate their connection. This security flaw arises from the ShiroFilter permitting public access to the sensitive SSE paths without verifying user identity against authenticated principals. It has been addressed in version 1.7.2.

References