CordysCRM CVE-2026-108705

Exploitation requires an authenticated session as any low-privileged CordysCRM user (PR:L) who can reach the POST /custom-form/data/import endpoint; no user interaction or elevated role is needed. The specific prerequisite is knowledge or enumeration of a target customFormId that the attacker's account is not permitted to manage, plus the ability to supply an Excel file with importType set to ADD or UPDATE. The limiting factor is the authentication requirement - this is not exploitable by fully unauthenticated attackers - so realistic risk is concentrated in environments with many low-trust user accounts or weak account provisioning; impact is bounded to data integrity of custom forms (record creation/overwrite), with no confidentiality or availability effect indicated.

This is a genuine but moderate-priority issue, not a high-severity emergency. The vendor CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and correctly reflects a low-privilege, network-reachable flaw with impact limited to integrity (VI:L); confidentiality (VC:N) and availability (VA:N) are explicitly unaffected, consistent with the description, which involves writing/overwriting records rather than reading or denying service. The CWE-862 (Missing Authorization) classification aligns with the described behavior: an authenticated low-privileged user manipulates the customFormId parameter to act on forms outside their permission scope. Publicly available exploit code exists (VulnCheck advisory plus a GitHub POC), which raises the practical likelihood of opportunistic abuse by insiders or attackers who already hold any valid account. However, no CISA KEV listing and no EPSS score are provided in the input, so there is no evidence of active exploitation or a quantified exploitation probability - treat exploitation likelihood as unquantified. There is no SSVC decision data in the input. The signals are internally consistent (PR:L matches the 'authenticated users' / 'low-privileged attackers' language), so no contradiction needs vendor verification; the main caveat is that real risk is gated behind holding a valid account on the target instance.

An attacker who holds any low-privileged CordysCRM account (through 1.9.3) sends a POST request to /custom-form/data/import referencing a customFormId they are not authorized to manage, attaching an Excel file with importType ADD or UPDATE. Because the endpoint omits an authorization check, the server creates new records in or overwrites existing records of that restricted custom form, corrupting or injecting business data. A public POC (poc_custom_form_data_import.py) demonstrates the request, lowering the skill barrier.