EUVD-2026-83372Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Anonymous network endpoint (PR:N, AV:N) with no victim interaction (UI:N); AC:H because a valid IDGenerator id must be guessed or observed; read-only file download yields C:L and I:N/A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/{id} and /pic/preview/{id} as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key lookup without ownership, organization, or permission checks. An unauthenticated caller who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations because the stored organization id is used only to locate the file rather than authorize the caller. This issue is fixed in version 1.7.4.
AnalysisAI
Unauthenticated tenants can read other organizations' uploaded files in CordysCRM (1Panel-dev) versions prior to 1.7.4, because the Shiro-configured anonymous routes /attachment/preview/{id} and /pic/preview/{id} resolve attachments through AttachmentService.getResource with a bare primary-key lookup and no ownership, organization, or permission check. Exploitation requires the attacker to know, guess, or observe a valid IDGenerator.nextStr file id; the ids are not sequentially predictable, which raises attack complexity, but ids leaked through shared preview links, logs, or browser history permit direct retrieval. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Affected deployments of CordysCRM prior to 1.7.4 where ShiroFilter marks /attachment/preview/{id} and /pic/preview/{id} as anonymous (the default configuration) - no authentication is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine unauthenticated broken-access-control (IDOR) flaw but a moderate real-world priority, not a critical emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary fix: upgrade CordysCRM to version 1.7.4 or later (vendor-released patch: 1.7.4), available at the v1.7.4 release tag, with the change implemented in PR #2978 and commit 3d1f68be0778ce35362688296bf355c1cb2d86fb and documented in advisory GHSA-93p7-j9r5-jc7q; this adds the FileAccessAuthFilter to the Shiro chain and issues a file-access token cookie through the SSO callbacks so that preview requests are no longer satisfied by a bare id. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
CordysCRM before 1.7.2 exposes its SSE notification endpoints anonymously, allowing a remote unauthenticated attacker wh
Unauthenticated information disclosure in CordysCRM (1Panel-dev) versions prior to 1.7.2 lets any network-reachable call
CordysCRM 1.7.3 and earlier allows an authenticated user holding the PROCESS_SETTING_ADD permission to store an attacker
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerc
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to m
Stored cross-site scripting in CordysCRM (1Panel-dev, versions up to 1.4.1) allows an authenticated remote attacker to i
Broken object-level authorization (IDOR/BOLA) in CordysCRM allows any authenticated user holding the ordinary CLUE_MANAG
Error-based SQL injection in CordysCRM 1.7.0 through pre-1.7.4 lets an authenticated user holding the MODULE_SETTING_UPD
Time-based blind SQL injection in CordysCRM versions prior to 1.7.0 allows an authenticated attacker holding the MODULE_
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today