EUVD-2026-83361Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated remote SSE endpoints (PR:N/AV:N/AC:L); C:H for leaked approvals/mentions, I:L (only heartbeat injection), A:L (single-user channel close).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.
AnalysisAI
CordysCRM before 1.7.2 exposes its SSE notification endpoints anonymously, allowing a remote unauthenticated attacker who can reach the backend HTTP interface to read another user's workflow events, approval requests, mentions, and alerts, inject SYSTEM_HEARTBEAT messages into that user's stream, or close that user's SSE channel. The flaw is missing authentication (CWE-306) in the Shiro public-path whitelist and the controller's trust in a caller-supplied userId; the provided source advisory CVSS 4.0 score is 9.3, while the independent CVSS 3.1 assessment is 8.6 because confidentiality impact is high but integrity and availability impact are limited to a selected user's notification stream. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable against default configurations because ShiroFilter.addPublicPathFilters explicitly permits the /sse/subscribe, /sse/broadcast, and /sse/close paths as anonymous, so no authentication, credentials, or user interaction are required on any CordysCRM instance prior to 1.7.2 whose backend HTTP interface is network-reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 9.3 (Critical) is driven by a fully remote, unauthenticated vector (AV:N/AC:L/AT:N/PR:N/UI:N) against a genuine missing-authentication flaw (CWE-306): ShiroFilter.addPublicPathFilters explicitly whitelists the SSE paths, and the endpoints trust a caller-supplied userId rather than an authenticated principal - so the attack precondition is real and confirmed by the fix diff. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade CordysCRM to 1.7.2 or later; vendor-released patch: 1.7.2 (release tag v1.7.2, PR 2719, commit 6cb81deb, advisory GHSA-9qg8-cm35-xqp4). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, treat any internet- or wide-LAN-reachable CordysCRM backend HTTP interface as exposed: place the backend behind firewall rules or VPN-only access so that only trusted application tiers can reach it, and confirm no CordysCRM host is directly reachable from untrusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated information disclosure in CordysCRM (1Panel-dev) versions prior to 1.7.2 lets any network-reachable call
CordysCRM 1.7.3 and earlier allows an authenticated user holding the PROCESS_SETTING_ADD permission to store an attacker
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerc
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to m
Stored cross-site scripting in CordysCRM (1Panel-dev, versions up to 1.4.1) allows an authenticated remote attacker to i
Broken object-level authorization (IDOR/BOLA) in CordysCRM allows any authenticated user holding the ordinary CLUE_MANAG
Error-based SQL injection in CordysCRM 1.7.0 through pre-1.7.4 lets an authenticated user holding the MODULE_SETTING_UPD
Time-based blind SQL injection in CordysCRM versions prior to 1.7.0 allows an authenticated attacker holding the MODULE_
Unauthenticated tenants can read other organizations' uploaded files in CordysCRM (1Panel-dev) versions prior to 1.7.4,
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today