1Panel Dev

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-108692	Missing authorization in 1Panel-dev CordysCRM 1.9.0 up to (but not including) 1.9.2 lets an authenticated user who has been explicitly denied module permission page through organization-wide CRM records - leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices - that belong to other users. The flaw lies in eight ModuleFieldController /field/source data-source endpoints that omit the data-permission scope check, so a low-privilege account (CVSS PR:L, unauthenticated attackers cannot exploit it directly) can enumerate and read data it should never see; impact is confidentiality-only with no integrity or availability effect. Publicly available exploit code exists (a proof-of-concept script targeting the field/source endpoint family), and the vendor has released a fix in 1.9.2 via commit a31fa16f, which injects a dataPermission.invisible guard into the affected MyBatis mappers and the controller.	HIGH	7.1	0.2%	56	PoC
CVE-2026-108700	Missing authorization in 1Panel-dev CordysCRM before 1.9.2 lets any authenticated low-privileged user read organization invoicing entities by sending POST /field/source/business-title, an endpoint that performs no permission check and therefore ignores the CONTRACT_BUSINESS_TITLE_READ privilege. Successful exploitation exposes tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers of customer organizations, giving an attacker a ready-made dataset for invoice fraud, business email compromise, and social engineering. Publicly available exploit code exists (a Python PoC published on GitHub), and the issue is confirmed fixed in 1.9.2; per the CVSS:4.0 vector (PR:L, no UI, network-reachable), the practical barrier is simply holding valid low-privilege credentials, so an insider or a compromised standard account is enough to pull the data.	HIGH	7.1	0.2%	56	PoC
CVE-2026-77521	Command injection in MaxKB before 2.10.5-lts allows unauthenticated remote attackers to execute arbitrary shell commands when an assistant is configured with a tool, MCP tool, skill, or sub-application. Untrusted chat messages or ingested documents can coerce the LLM into invoking the un-gated `execute` shell tool, which lacks human approval and is exposed by the SandboxShellBackend. Both source deployments with MAXKB_SANDBOX disabled and the official root container's vulnerable gosu wrapper permit command execution outside the intended sandbox; no public exploit code or confirmed active exploitation was identified at time of analysis. A vendor patch is available in version 2.10.5-lts.	CRITICAL	10.0	1.0%	51
CVE-2026-63647	CordysCRM before 1.7.2 exposes its SSE notification endpoints anonymously, allowing a remote unauthenticated attacker who can reach the backend HTTP interface to read another user's workflow events, approval requests, mentions, and alerts, inject SYSTEM_HEARTBEAT messages into that user's stream, or close that user's SSE channel. The flaw is missing authentication (CWE-306) in the Shiro public-path whitelist and the controller's trust in a caller-supplied userId; the provided source advisory CVSS 4.0 score is 9.3, while the independent CVSS 3.1 assessment is 8.6 because confidentiality impact is high but integrity and availability impact are limited to a selected user's notification stream. No CISA KEV entry or public exploit code was identified at time of analysis, but exploitation requires only network reachability and a target userId.	CRITICAL	9.3	0.5%	47
CVE-2026-108702	Blind SSRF in CordysCRM through 1.9.3 allows any authenticated user to call POST /approval-flow/webhook/test without the required PROCESS_SETTING permission, causing the server to issue outbound requests to an attacker-supplied URL. An attacker-controlled host can redirect the request to bypass SSRFValidator and use the endpoint's success or failure results to probe internal addresses. Publicly available exploit code exists, and the assessed impact is a low-privilege broken-access-control flaw with only low confidentiality exposure and no confirmed active exploitation.	MEDIUM	5.3	0.2%	47	PoC No patch
CVE-2026-108704	Authorization bypass in CordysCRM through 1.9.3 allows low-privileged authenticated users to add follow-up records and overwrite follow_time and follower on any known customer, clue, or opportunity by setting the owner field to their own user id. Exploitation requires a valid low-privileged account and knowledge of a target record ID; the impact is limited to integrity of follow-up records with no confidentiality or availability effect. Publicly available exploit code exists, though CISA KEV does not list this as actively exploited. This is a moderate-priority authenticated-only vulnerability (CWE-639).	MEDIUM	5.3	0.2%	47	PoC No patch
CVE-2026-108701	Missing authorization in CordysCRM's ContractController sort handler (POST /contract/sort) lets any authenticated user - even one without contract update permission - modify contract records, including contracts belonging to other organizations, by supplying dragNodeId, stage, and field values. The flaw is CWE-862 and affects all versions before 1.9.2; publicly available exploit code exists, though there is no confirmation of active exploitation in CISA KEV. Impact is confined to contract-record integrity (no data disclosure or service disruption), making this a moderate-severity Broken Function Level Authorization issue rather than a critical breach.	MEDIUM	5.3	0.2%	47	PoC
CVE-2026-108705	Authenticated low-privileged users of CordysCRM through 1.9.3 can create or overwrite records inside custom forms they are not permitted to manage, because the POST /custom-form/data/import endpoint never verifies the caller's rights over the submitted customFormId (CWE-862). Exploitation needs only a valid low-privilege session plus an Excel file with importType set to ADD or UPDATE, and publicly available exploit code exists (a PoC script is published on GitHub); however, there is no confirmation of active exploitation (not in CISA KEV). With a CVSS 4.0 base score of 5.3 and impact confined to data integrity, this is a genuine but moderate-priority issue rather than a high-severity emergency.	MEDIUM	5.3	0.2%	47	PoC No patch
CVE-2026-56779	Server-side request forgery in MaxKB before 2.10.0 allows any authenticated user holding the default workspace USER role to coerce the application server into making arbitrary HTTP requests to attacker-controlled destinations via the `downloadCallbackUrl` and `download_url` parameters on ToolSerializer endpoints. An attacker can pivot through the MaxKB host to probe and extract data from internal network services - cloud metadata APIs, internal databases, adjacent microservices - that would otherwise be inaccessible from outside the network perimeter. A public proof-of-concept exists at GitHub issue #6272; this is not confirmed actively exploited (not in CISA KEV).	MEDIUM	5.3	0.2%	47	PoC
CVE-2026-108703	Broken access control in CordysCRM through 1.9.3 allows any authenticated low-privileged user to submit arbitrary business resources for approval by calling POST /approval-resource/push without any ownership check, altering approval status and exposing approval details for contracts, invoices, quotations, and orders. The flaw is remotely reachable with a valid session but requires authentication (PR:L), and impact is bounded to low confidentiality and integrity loss with no availability or system-level effect. Publicly available exploit code exists, including a proof-of-concept script, but there is no confirmation of active exploitation, and no vendor-released patch was identified in the available data at time of analysis.	MEDIUM	5.3	0.2%	47	PoC No patch
CVE-2026-79916	Authenticated workspace members on MaxKB deployments prior to 2.10.5-lts can escalate to root-level command execution by abusing how the AWS Bedrock provider stores credentials. Because MaxKB writes user-supplied access_key_id and secret_access_key values into /root/.aws/credentials without proper parsing, an attacker can smuggle control characters and a forged [profile] block containing a credential_process directive, then trigger a later model-validation request that makes botocore run an attacker-controlled command as root. Exploitation requires valid workspace credentials, the reachable Bedrock provider configuration path, and a two-step inject-then-trigger sequence on a service running with root privileges; vendor-released patch 2.10.5-lts is available and no public exploit identified at time of analysis.	CRITICAL	9.1	0.3%	46
CVE-2026-54149	OS command injection in MaxKB (1Panel-dev's open-source enterprise AI assistant) before 2.10.0-lts lets an authenticated user achieve arbitrary command execution on the host by importing a crafted .tool file that declares an MCP stdio transport and triggering it through an AI Chat node. Because the tool-import path (apps/tools/serializers/tool.py) and the MCP referencing path (base_chat_step.py) fail to consistently validate the MCP transport type, the MultiServerMCPClient spawns the attacker's stdio command locally. Rated CVSS 8.8; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.	HIGH	8.8	0.4%	44
CVE-2026-44847	Authentication bypass in MaxKB (1Panel-dev) versions prior to 2.9.0 allows remote unauthenticated attackers to invoke webhook trigger endpoints and execute their bound tasks. The flaw stems from the WebhookAuth class unconditionally returning a successful authentication tuple, which Django REST Framework interprets as a valid identity, combined with no backend enforcement of per-trigger token requirements. No public exploit identified at time of analysis, but the trivial nature of the bypass and open-source visibility of the patch make exploitation straightforward for any attacker who can enumerate or guess trigger IDs.	HIGH	7.5	0.1%	38
CVE-2026-77523	Cross-workspace read and modification of model parameter defaults in MaxKB 2.10.3-lts and earlier is possible for an authenticated user who holds model-read permission in a workspace they control, simply by supplying a model_id that belongs to a victim workspace. The model parameter form route checks authorization against the workspace in the URL path, but the underlying ModelSerializer.ModelParams fetches the Model by id alone without filtering on workspace_id, so the object-level check is bypassed (CWE-639, CVSS 3.1 base 7.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Impact is bounded: it is limited to reading or overwriting the victim's model_params_form, which can indirectly alter the default behavior of workflows that consume that model, and practical exploitation requires a multi-tenant deployment plus knowledge or guessing of a valid victim model_id; no public exploit identified at time of analysis and no fixed version is available as of this review.	HIGH	7.4	0.2%	37	No patch
CVE-2026-63646	Unauthenticated information disclosure in CordysCRM (1Panel-dev) versions prior to 1.7.2 lets any network-reachable caller retrieve CRM form metadata via GET /mcp/form/config/{formKey}, exposing field names, types, required flags, default values, options, validation rules, and binding sources. The flaw exists because ShiroFilter marks the /mcp/** path as anonymous and McpController.getMcpField carries no permission annotation, so the endpoint is reachable without credentials (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is limited to schema/metadata disclosure rather than direct access to customer records, and no public exploit code has been identified at time of analysis; exploitation does require knowledge or brute-forcing of valid formKey identifiers.	MEDIUM	6.9	0.5%	35

CVE-2026-108692

Missing authorization in 1Panel-dev CordysCRM 1.9.0 up to (but not including) 1.9.2 lets an authenticated user who has been explicitly denied module permission page through organization-wide CRM records - leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices - that belong to other users. The flaw lies in eight ModuleFieldController /field/source data-source endpoints that omit the data-permission scope check, so a low-privilege account (CVSS PR:L, unauthenticated attackers cannot exploit it directly) can enumerate and read data it should never see; impact is confidentiality-only with no integrity or availability effect. Publicly available exploit code exists (a proof-of-concept script targeting the field/source endpoint family), and the vendor has released a fix in 1.9.2 via commit a31fa16f, which injects a dataPermission.invisible guard into the affected MyBatis mappers and the controller.

HIGH

7.1

0.2%

56

PoC

CVE-2026-108700

Missing authorization in 1Panel-dev CordysCRM before 1.9.2 lets any authenticated low-privileged user read organization invoicing entities by sending POST /field/source/business-title, an endpoint that performs no permission check and therefore ignores the CONTRACT_BUSINESS_TITLE_READ privilege. Successful exploitation exposes tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers of customer organizations, giving an attacker a ready-made dataset for invoice fraud, business email compromise, and social engineering. Publicly available exploit code exists (a Python PoC published on GitHub), and the issue is confirmed fixed in 1.9.2; per the CVSS:4.0 vector (PR:L, no UI, network-reachable), the practical barrier is simply holding valid low-privilege credentials, so an insider or a compromised standard account is enough to pull the data.

HIGH

7.1

0.2%

56

PoC

CVE-2026-77521

Command injection in MaxKB before 2.10.5-lts allows unauthenticated remote attackers to execute arbitrary shell commands when an assistant is configured with a tool, MCP tool, skill, or sub-application. Untrusted chat messages or ingested documents can coerce the LLM into invoking the un-gated `execute` shell tool, which lacks human approval and is exposed by the SandboxShellBackend. Both source deployments with MAXKB_SANDBOX disabled and the official root container's vulnerable gosu wrapper permit command execution outside the intended sandbox; no public exploit code or confirmed active exploitation was identified at time of analysis. A vendor patch is available in version 2.10.5-lts.

CRITICAL

10.0

1.0%

51

CVE-2026-63647

CordysCRM before 1.7.2 exposes its SSE notification endpoints anonymously, allowing a remote unauthenticated attacker who can reach the backend HTTP interface to read another user's workflow events, approval requests, mentions, and alerts, inject SYSTEM_HEARTBEAT messages into that user's stream, or close that user's SSE channel. The flaw is missing authentication (CWE-306) in the Shiro public-path whitelist and the controller's trust in a caller-supplied userId; the provided source advisory CVSS 4.0 score is 9.3, while the independent CVSS 3.1 assessment is 8.6 because confidentiality impact is high but integrity and availability impact are limited to a selected user's notification stream. No CISA KEV entry or public exploit code was identified at time of analysis, but exploitation requires only network reachability and a target userId.

CRITICAL

9.3

0.5%

47

CVE-2026-108702

Blind SSRF in CordysCRM through 1.9.3 allows any authenticated user to call POST /approval-flow/webhook/test without the required PROCESS_SETTING permission, causing the server to issue outbound requests to an attacker-supplied URL. An attacker-controlled host can redirect the request to bypass SSRFValidator and use the endpoint's success or failure results to probe internal addresses. Publicly available exploit code exists, and the assessed impact is a low-privilege broken-access-control flaw with only low confidentiality exposure and no confirmed active exploitation.

MEDIUM

5.3

0.2%

47

PoC No patch

CVE-2026-108704

Authorization bypass in CordysCRM through 1.9.3 allows low-privileged authenticated users to add follow-up records and overwrite follow_time and follower on any known customer, clue, or opportunity by setting the owner field to their own user id. Exploitation requires a valid low-privileged account and knowledge of a target record ID; the impact is limited to integrity of follow-up records with no confidentiality or availability effect. Publicly available exploit code exists, though CISA KEV does not list this as actively exploited. This is a moderate-priority authenticated-only vulnerability (CWE-639).

MEDIUM

5.3

0.2%

47

PoC No patch

CVE-2026-108701

Missing authorization in CordysCRM's ContractController sort handler (POST /contract/sort) lets any authenticated user - even one without contract update permission - modify contract records, including contracts belonging to other organizations, by supplying dragNodeId, stage, and field values. The flaw is CWE-862 and affects all versions before 1.9.2; publicly available exploit code exists, though there is no confirmation of active exploitation in CISA KEV. Impact is confined to contract-record integrity (no data disclosure or service disruption), making this a moderate-severity Broken Function Level Authorization issue rather than a critical breach.

MEDIUM

5.3

0.2%

47

PoC

CVE-2026-108705

Authenticated low-privileged users of CordysCRM through 1.9.3 can create or overwrite records inside custom forms they are not permitted to manage, because the POST /custom-form/data/import endpoint never verifies the caller's rights over the submitted customFormId (CWE-862). Exploitation needs only a valid low-privilege session plus an Excel file with importType set to ADD or UPDATE, and publicly available exploit code exists (a PoC script is published on GitHub); however, there is no confirmation of active exploitation (not in CISA KEV). With a CVSS 4.0 base score of 5.3 and impact confined to data integrity, this is a genuine but moderate-priority issue rather than a high-severity emergency.

MEDIUM

5.3

0.2%

47

PoC No patch

CVE-2026-56779

Server-side request forgery in MaxKB before 2.10.0 allows any authenticated user holding the default workspace USER role to coerce the application server into making arbitrary HTTP requests to attacker-controlled destinations via the `downloadCallbackUrl` and `download_url` parameters on ToolSerializer endpoints. An attacker can pivot through the MaxKB host to probe and extract data from internal network services - cloud metadata APIs, internal databases, adjacent microservices - that would otherwise be inaccessible from outside the network perimeter. A public proof-of-concept exists at GitHub issue #6272; this is not confirmed actively exploited (not in CISA KEV).

MEDIUM

5.3

0.2%

47

PoC

CVE-2026-108703

Broken access control in CordysCRM through 1.9.3 allows any authenticated low-privileged user to submit arbitrary business resources for approval by calling POST /approval-resource/push without any ownership check, altering approval status and exposing approval details for contracts, invoices, quotations, and orders. The flaw is remotely reachable with a valid session but requires authentication (PR:L), and impact is bounded to low confidentiality and integrity loss with no availability or system-level effect. Publicly available exploit code exists, including a proof-of-concept script, but there is no confirmation of active exploitation, and no vendor-released patch was identified in the available data at time of analysis.

MEDIUM

5.3

0.2%

47

PoC No patch

CVE-2026-79916

Authenticated workspace members on MaxKB deployments prior to 2.10.5-lts can escalate to root-level command execution by abusing how the AWS Bedrock provider stores credentials. Because MaxKB writes user-supplied access_key_id and secret_access_key values into /root/.aws/credentials without proper parsing, an attacker can smuggle control characters and a forged [profile] block containing a credential_process directive, then trigger a later model-validation request that makes botocore run an attacker-controlled command as root. Exploitation requires valid workspace credentials, the reachable Bedrock provider configuration path, and a two-step inject-then-trigger sequence on a service running with root privileges; vendor-released patch 2.10.5-lts is available and no public exploit identified at time of analysis.

CRITICAL

9.1

0.3%

46

CVE-2026-54149

OS command injection in MaxKB (1Panel-dev's open-source enterprise AI assistant) before 2.10.0-lts lets an authenticated user achieve arbitrary command execution on the host by importing a crafted .tool file that declares an MCP stdio transport and triggering it through an AI Chat node. Because the tool-import path (apps/tools/serializers/tool.py) and the MCP referencing path (base_chat_step.py) fail to consistently validate the MCP transport type, the MultiServerMCPClient spawns the attacker's stdio command locally. Rated CVSS 8.8; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.

HIGH

8.8

0.4%

44

CVE-2026-44847

Authentication bypass in MaxKB (1Panel-dev) versions prior to 2.9.0 allows remote unauthenticated attackers to invoke webhook trigger endpoints and execute their bound tasks. The flaw stems from the WebhookAuth class unconditionally returning a successful authentication tuple, which Django REST Framework interprets as a valid identity, combined with no backend enforcement of per-trigger token requirements. No public exploit identified at time of analysis, but the trivial nature of the bypass and open-source visibility of the patch make exploitation straightforward for any attacker who can enumerate or guess trigger IDs.

HIGH

7.5

0.1%

38

CVE-2026-77523

Cross-workspace read and modification of model parameter defaults in MaxKB 2.10.3-lts and earlier is possible for an authenticated user who holds model-read permission in a workspace they control, simply by supplying a model_id that belongs to a victim workspace. The model parameter form route checks authorization against the workspace in the URL path, but the underlying ModelSerializer.ModelParams fetches the Model by id alone without filtering on workspace_id, so the object-level check is bypassed (CWE-639, CVSS 3.1 base 7.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Impact is bounded: it is limited to reading or overwriting the victim's model_params_form, which can indirectly alter the default behavior of workflows that consume that model, and practical exploitation requires a multi-tenant deployment plus knowledge or guessing of a valid victim model_id; no public exploit identified at time of analysis and no fixed version is available as of this review.

HIGH

7.4

0.2%

37

No patch

CVE-2026-63646

Unauthenticated information disclosure in CordysCRM (1Panel-dev) versions prior to 1.7.2 lets any network-reachable caller retrieve CRM form metadata via GET /mcp/form/config/{formKey}, exposing field names, types, required flags, default values, options, validation rules, and binding sources. The flaw exists because ShiroFilter marks the /mcp/** path as anonymous and McpController.getMcpField carries no permission annotation, so the endpoint is reachable without credentials (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is limited to schema/metadata disclosure rather than direct access to customer records, and no public exploit code has been identified at time of analysis; exploitation does require knowledge or brute-forcing of valid formKey identifiers.

MEDIUM

6.9

0.5%

35

Severity Breakdown

Monthly CVE Trend

Affected Products (5)

Top Risky CVEs