CordysCRM CVE-2026-108704

Requires a valid low-privileged authenticated account on the CordysCRM instance (PR:L) and knowledge of a target record ID for an existing customer, clue, or opportunity. The specific prerequisite is that the follow/record/add endpoints (CustomerFollowRecordController, ClueFollowRecordController, FollowUpRecordController / BaseFollowUpService) trust a client-supplied owner field as the permission check, so an attacker simply sets owner to their own user id to bypass ownership enforcement. Limiting factors that reduce real-world risk: exploitation is impossible without credentials, impact is confined to the integrity of follow-up records (follow_time, follower) with no confidentiality or availability effect, and the attacker must already know valid target record identifiers.

This is a moderate, authenticated-only authorization bypass (CWE-639, insecure direct object reference via a user-controlled owner field), not a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires existing low-privileged credentials (PR:L), so it is NOT unauthenticated. Impact is narrow: VI:L with VC:N and VA:N means integrity-only - an attacker can write/overwrite follow-up records (follow_time, follower) on records they do not own, but cannot read confidential data or cause availability loss. A public PoC exists (poc_follow_record_add.py), which raises practical exploitability, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no evidence of active or widespread exploitation. The signals are internally consistent (low-severity integrity flaw, authenticated vector, PoC available), so the realistic picture is a low-complexity but low-impact flaw that matters mainly for multi-tenant CRM deployments where data integrity and attribution matter. No EPSS or SSVC data was supplied; that absence is noted rather than inferred.

A low-privileged authenticated CRM user crafts requests to the follow/record/add endpoints, setting the owner field to their own user id so the request passes the permission check, then adds or overwrites follow-up records on customers, clues, or opportunities they do not own. A public Python PoC (poc_follow_record_add.py) demonstrates this against known record IDs. Because CVSS is AV:N/AC:L, the requests are simple HTTP calls requiring only valid low-privilege credentials and no user interaction.