EUVD-2026-83364Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Ordinary READ permission means PR:L not PR:H; supplying another record's id is trivial (AC:L); confined to app data (S:U); read-only PII disclosure so C:H, I:N, A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4.
AnalysisAI
Broken object-level authorization (IDOR/BOLA) in CordysCRM allows any authenticated user holding the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission to read leads and customer accounts belonging to other users, departments, or organizations by supplying an arbitrary record ID to GET /pool/lead/get/{id} or GET /pool/account/get/{id}. The flaw affects all CordysCRM deployments prior to version 1.7.4 and is read-only in effect, but it exposes highly sensitive CRM data including contact names, phone numbers, owner and department attribution, and custom field values, with no special privileges, administrative rights, or non-default configuration required beyond valid credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated CordysCRM account (pre-1.7.4) holding the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a broken-object-level-authorization (IDOR/BOLA, CWE-639) information-disclosure flaw, not a critical RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to CordysCRM 1.7.4, which resolves the missing per-record scope binding by adding pool-membership/organization validation (checkPoolMember with SessionUtils.getUserId() and OrganizationContext.getOrganizationId()) ahead of the vulnerable getters and other pool endpoints - see https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4, advisory GHSA-hxp2-5w5p-2grq, PR https://github.com/1Panel-dev/CordysCRM/pull/2976, and commit 34c7c3e5de2585208744926007530037a4ce4da5. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
CordysCRM before 1.7.2 exposes its SSE notification endpoints anonymously, allowing a remote unauthenticated attacker wh
Unauthenticated information disclosure in CordysCRM (1Panel-dev) versions prior to 1.7.2 lets any network-reachable call
CordysCRM 1.7.3 and earlier allows an authenticated user holding the PROCESS_SETTING_ADD permission to store an attacker
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerc
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to m
Stored cross-site scripting in CordysCRM (1Panel-dev, versions up to 1.4.1) allows an authenticated remote attacker to i
Error-based SQL injection in CordysCRM 1.7.0 through pre-1.7.4 lets an authenticated user holding the MODULE_SETTING_UPD
Time-based blind SQL injection in CordysCRM versions prior to 1.7.0 allows an authenticated attacker holding the MODULE_
Unauthenticated tenants can read other organizations' uploaded files in CordysCRM (1Panel-dev) versions prior to 1.7.4,
Share
External POC / Exploit Code
Leaving vuln.today