CordysCRM Missing Authorization and Permission Bypass

Missing authorization in 1Panel-dev CordysCRM 1.9.0 up to (but not including) 1.9.2 lets an authenticated user who has been explicitly denied module permission page through organization-wide CRM records - leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices - that belong to other users. The flaw lies in eight ModuleFieldController /field/source data-source endpoints that omit the data-permission scope check, so a low-privilege account (CVSS PR:L, unauthenticated attackers cannot exploit it directly) can enumerate and read data it should never see; impact is confidentiality-only with no integrity or availability effect. Publicly available exploit code exists (a proof-of-concept script targeting the field/source endpoint family), and the vendor has released a fix in 1.9.2 via commit a31fa16f, which injects a dataPermission.invisible guard into the affected MyBatis mappers and the controller.

Missing authorization in 1Panel-dev CordysCRM before 1.9.2 lets any authenticated low-privileged user read organization invoicing entities by sending POST /field/source/business-title, an endpoint that performs no permission check and therefore ignores the CONTRACT_BUSINESS_TITLE_READ privilege. Successful exploitation exposes tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers of customer organizations, giving an attacker a ready-made dataset for invoice fraud, business email compromise, and social engineering. Publicly available exploit code exists (a Python PoC published on GitHub), and the issue is confirmed fixed in 1.9.2; per the CVSS:4.0 vector (PR:L, no UI, network-reachable), the practical barrier is simply holding valid low-privilege credentials, so an insider or a compromised standard account is enough to pull the data.

Blind SSRF in CordysCRM through 1.9.3 allows any authenticated user to call POST /approval-flow/webhook/test without the required PROCESS_SETTING permission, causing the server to issue outbound requests to an attacker-supplied URL. An attacker-controlled host can redirect the request to bypass SSRFValidator and use the endpoint's success or failure results to probe internal addresses. Publicly available exploit code exists, and the assessed impact is a low-privilege broken-access-control flaw with only low confidentiality exposure and no confirmed active exploitation.

Broken access control in CordysCRM through 1.9.3 allows any authenticated low-privileged user to submit arbitrary business resources for approval by calling POST /approval-resource/push without any ownership check, altering approval status and exposing approval details for contracts, invoices, quotations, and orders. The flaw is remotely reachable with a valid session but requires authentication (PR:L), and impact is bounded to low confidentiality and integrity loss with no availability or system-level effect. Publicly available exploit code exists, including a proof-of-concept script, but there is no confirmation of active exploitation, and no vendor-released patch was identified in the available data at time of analysis.

Authorization bypass in CordysCRM through 1.9.3 allows low-privileged authenticated users to add follow-up records and overwrite follow_time and follower on any known customer, clue, or opportunity by setting the owner field to their own user id. Exploitation requires a valid low-privileged account and knowledge of a target record ID; the impact is limited to integrity of follow-up records with no confidentiality or availability effect. Publicly available exploit code exists, though CISA KEV does not list this as actively exploited. This is a moderate-priority authenticated-only vulnerability (CWE-639).

Missing authorization in CordysCRM's ContractController sort handler (POST /contract/sort) lets any authenticated user - even one without contract update permission - modify contract records, including contracts belonging to other organizations, by supplying dragNodeId, stage, and field values. The flaw is CWE-862 and affects all versions before 1.9.2; publicly available exploit code exists, though there is no confirmation of active exploitation in CISA KEV. Impact is confined to contract-record integrity (no data disclosure or service disruption), making this a moderate-severity Broken Function Level Authorization issue rather than a critical breach.

Authenticated low-privileged users of CordysCRM through 1.9.3 can create or overwrite records inside custom forms they are not permitted to manage, because the POST /custom-form/data/import endpoint never verifies the caller's rights over the submitted customFormId (CWE-862). Exploitation needs only a valid low-privilege session plus an Excel file with importType set to ADD or UPDATE, and publicly available exploit code exists (a PoC script is published on GitHub); however, there is no confirmation of active exploitation (not in CISA KEV). With a CVSS 4.0 base score of 5.3 and impact confined to data integrity, this is a genuine but moderate-priority issue rather than a high-severity emergency.