1Panel Dev

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-108692	Missing authorization in 1Panel-dev CordysCRM 1.9.0 up to (but not including) 1.9.2 lets an authenticated user who has been explicitly denied module permission page through organization-wide CRM records - leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices - that belong to other users. The flaw lies in eight ModuleFieldController /field/source data-source endpoints that omit the data-permission scope check, so a low-privilege account (CVSS PR:L, unauthenticated attackers cannot exploit it directly) can enumerate and read data it should never see; impact is confidentiality-only with no integrity or availability effect. Publicly available exploit code exists (a proof-of-concept script targeting the field/source endpoint family), and the vendor has released a fix in 1.9.2 via commit a31fa16f, which injects a dataPermission.invisible guard into the affected MyBatis mappers and the controller.	HIGH	7.1	0.2%	56	PoC
CVE-2026-108700	Missing authorization in 1Panel-dev CordysCRM before 1.9.2 lets any authenticated low-privileged user read organization invoicing entities by sending POST /field/source/business-title, an endpoint that performs no permission check and therefore ignores the CONTRACT_BUSINESS_TITLE_READ privilege. Successful exploitation exposes tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers of customer organizations, giving an attacker a ready-made dataset for invoice fraud, business email compromise, and social engineering. Publicly available exploit code exists (a Python PoC published on GitHub), and the issue is confirmed fixed in 1.9.2; per the CVSS:4.0 vector (PR:L, no UI, network-reachable), the practical barrier is simply holding valid low-privilege credentials, so an insider or a compromised standard account is enough to pull the data.	HIGH	7.1	0.2%	56	PoC
CVE-2026-77521	Command injection in MaxKB before 2.10.5-lts allows unauthenticated remote attackers to execute arbitrary shell commands when an assistant is configured with a tool, MCP tool, skill, or sub-application. Untrusted chat messages or ingested documents can coerce the LLM into invoking the un-gated `execute` shell tool, which lacks human approval and is exposed by the SandboxShellBackend. Both source deployments with MAXKB_SANDBOX disabled and the official root container's vulnerable gosu wrapper permit command execution outside the intended sandbox; no public exploit code or confirmed active exploitation was identified at time of analysis. A vendor patch is available in version 2.10.5-lts.	CRITICAL	10.0	1.0%	51
CVE-2026-63647	CordysCRM before 1.7.2 exposes its SSE notification endpoints anonymously, allowing a remote unauthenticated attacker who can reach the backend HTTP interface to read another user's workflow events, approval requests, mentions, and alerts, inject SYSTEM_HEARTBEAT messages into that user's stream, or close that user's SSE channel. The flaw is missing authentication (CWE-306) in the Shiro public-path whitelist and the controller's trust in a caller-supplied userId; the provided source advisory CVSS 4.0 score is 9.3, while the independent CVSS 3.1 assessment is 8.6 because confidentiality impact is high but integrity and availability impact are limited to a selected user's notification stream. No CISA KEV entry or public exploit code was identified at time of analysis, but exploitation requires only network reachability and a target userId.	CRITICAL	9.3	0.5%	47
CVE-2026-108702	Blind SSRF in CordysCRM through 1.9.3 allows any authenticated user to call POST /approval-flow/webhook/test without the required PROCESS_SETTING permission, causing the server to issue outbound requests to an attacker-supplied URL. An attacker-controlled host can redirect the request to bypass SSRFValidator and use the endpoint's success or failure results to probe internal addresses. Publicly available exploit code exists, and the assessed impact is a low-privilege broken-access-control flaw with only low confidentiality exposure and no confirmed active exploitation.	MEDIUM	5.3	0.2%	47	PoC No patch
CVE-2026-108704	Authorization bypass in CordysCRM through 1.9.3 allows low-privileged authenticated users to add follow-up records and overwrite follow_time and follower on any known customer, clue, or opportunity by setting the owner field to their own user id. Exploitation requires a valid low-privileged account and knowledge of a target record ID; the impact is limited to integrity of follow-up records with no confidentiality or availability effect. Publicly available exploit code exists, though CISA KEV does not list this as actively exploited. This is a moderate-priority authenticated-only vulnerability (CWE-639).	MEDIUM	5.3	0.2%	47	PoC No patch
CVE-2026-108701	Missing authorization in CordysCRM's ContractController sort handler (POST /contract/sort) lets any authenticated user - even one without contract update permission - modify contract records, including contracts belonging to other organizations, by supplying dragNodeId, stage, and field values. The flaw is CWE-862 and affects all versions before 1.9.2; publicly available exploit code exists, though there is no confirmation of active exploitation in CISA KEV. Impact is confined to contract-record integrity (no data disclosure or service disruption), making this a moderate-severity Broken Function Level Authorization issue rather than a critical breach.	MEDIUM	5.3	0.2%	47	PoC
CVE-2026-108705	Authenticated low-privileged users of CordysCRM through 1.9.3 can create or overwrite records inside custom forms they are not permitted to manage, because the POST /custom-form/data/import endpoint never verifies the caller's rights over the submitted customFormId (CWE-862). Exploitation needs only a valid low-privilege session plus an Excel file with importType set to ADD or UPDATE, and publicly available exploit code exists (a PoC script is published on GitHub); however, there is no confirmation of active exploitation (not in CISA KEV). With a CVSS 4.0 base score of 5.3 and impact confined to data integrity, this is a genuine but moderate-priority issue rather than a high-severity emergency.	MEDIUM	5.3	0.2%	47	PoC No patch
CVE-2026-108703	Broken access control in CordysCRM through 1.9.3 allows any authenticated low-privileged user to submit arbitrary business resources for approval by calling POST /approval-resource/push without any ownership check, altering approval status and exposing approval details for contracts, invoices, quotations, and orders. The flaw is remotely reachable with a valid session but requires authentication (PR:L), and impact is bounded to low confidentiality and integrity loss with no availability or system-level effect. Publicly available exploit code exists, including a proof-of-concept script, but there is no confirmation of active exploitation, and no vendor-released patch was identified in the available data at time of analysis.	MEDIUM	5.3	0.2%	47	PoC No patch
CVE-2026-79916	Authenticated workspace members on MaxKB deployments prior to 2.10.5-lts can escalate to root-level command execution by abusing how the AWS Bedrock provider stores credentials. Because MaxKB writes user-supplied access_key_id and secret_access_key values into /root/.aws/credentials without proper parsing, an attacker can smuggle control characters and a forged [profile] block containing a credential_process directive, then trigger a later model-validation request that makes botocore run an attacker-controlled command as root. Exploitation requires valid workspace credentials, the reachable Bedrock provider configuration path, and a two-step inject-then-trigger sequence on a service running with root privileges; vendor-released patch 2.10.5-lts is available and no public exploit identified at time of analysis.	CRITICAL	9.1	0.3%	46
CVE-2026-77523	Cross-workspace read and modification of model parameter defaults in MaxKB 2.10.3-lts and earlier is possible for an authenticated user who holds model-read permission in a workspace they control, simply by supplying a model_id that belongs to a victim workspace. The model parameter form route checks authorization against the workspace in the URL path, but the underlying ModelSerializer.ModelParams fetches the Model by id alone without filtering on workspace_id, so the object-level check is bypassed (CWE-639, CVSS 3.1 base 7.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Impact is bounded: it is limited to reading or overwriting the victim's model_params_form, which can indirectly alter the default behavior of workflows that consume that model, and practical exploitation requires a multi-tenant deployment plus knowledge or guessing of a valid victim model_id; no public exploit identified at time of analysis and no fixed version is available as of this review.	HIGH	7.4	0.2%	37	No patch
CVE-2026-63646	Unauthenticated information disclosure in CordysCRM (1Panel-dev) versions prior to 1.7.2 lets any network-reachable caller retrieve CRM form metadata via GET /mcp/form/config/{formKey}, exposing field names, types, required flags, default values, options, validation rules, and binding sources. The flaw exists because ShiroFilter marks the /mcp/** path as anonymous and McpController.getMcpField carries no permission annotation, so the endpoint is reachable without credentials (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is limited to schema/metadata disclosure rather than direct access to customer records, and no public exploit code has been identified at time of analysis; exploitation does require knowledge or brute-forcing of valid formKey identifiers.	MEDIUM	6.9	0.5%	35
CVE-2026-76900	CordysCRM 1.7.3 and earlier allows an authenticated user holding the PROCESS_SETTING_ADD permission to store an attacker-chosen webhook URL in an approval-flow node and then cause the server to issue outbound HTTP requests to that URL when an approval action is approved, turning the application into a proxy for reaching internal-only services. The assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - high confidentiality impact against the attacked component with no integrity or availability impact - and the practical payoff is cloud metadata access (for example 169.254.169.254) and internal network reconnaissance, bounded by the server's network reach and by the multi-step trigger (configure via POST /approval-flow/add, fire via POST /approval-action/approve). The flaw is fixed in 1.7.4 per vendor advisory GHSA-fg6q-pfj7-fghw, PR #2966 and commit e0ae23e; no public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation requires a low-privileged authenticated account plus a second in-application approval step.	MEDIUM	6.8	0.4%	34	No patch
CVE-2026-79917	Broken authorization in MaxKB 2.7.0 through 2.10.4-lts lets an attacker who holds any valid chat token turn a victim's private conversation into a public ChatShareLink and create PublicFileAccess state that makes associated files retrievable without credentials. The POST /chat/api/{application_id}/chat/{chat_id}/share_chat handler verifies only that the conversation exists, never that it belongs to the caller's chat_user_id or to the application bound to the caller's token (CWE-285), and the exposure cannot be undone through the product because there is no revoke path. No public exploit identified at time of analysis and no vendor-released patch exists as of this review; the assessed CVSS 3.1 base score is 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N), with high attack complexity reflecting the need to know a specific, generally non-enumerable victim chat_id rather than any weakness in the request itself.	MEDIUM	6.5	0.2%	33	No patch
CVE-2026-79919	MaxKB releases prior to 2.10.6-lts allow an authenticated workspace member who can author and run function-library (tool) code to escape the built-in LD_PRELOAD syscall sandbox and act with the sandbox OS user's privileges, reading or writing files, spawning processes, and reaching networks that the sandbox was meant to block. The escape works because the sandbox's dlopen guard relied on a call-stack heuristic that can be satisfied from an importlib.abc.MetaPathFinder callback while loading ctypes, after which the real glibc syscall can be resolved with dlsym/RTLD_NEXT and invoked outside the interception layer. This is a protection-mechanism failure (CWE-693) rather than conventional unauthenticated RCE; the vendor-published score is 6.3, but the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H because once the sandbox is defeated the escaped user's file, process, and network access is fully available. No public exploit was identified at time of analysis, and the issue is fixed in 2.10.6-lts.	MEDIUM	6.3	0.3%	32

CVE-2026-108692

Missing authorization in 1Panel-dev CordysCRM 1.9.0 up to (but not including) 1.9.2 lets an authenticated user who has been explicitly denied module permission page through organization-wide CRM records - leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices - that belong to other users. The flaw lies in eight ModuleFieldController /field/source data-source endpoints that omit the data-permission scope check, so a low-privilege account (CVSS PR:L, unauthenticated attackers cannot exploit it directly) can enumerate and read data it should never see; impact is confidentiality-only with no integrity or availability effect. Publicly available exploit code exists (a proof-of-concept script targeting the field/source endpoint family), and the vendor has released a fix in 1.9.2 via commit a31fa16f, which injects a dataPermission.invisible guard into the affected MyBatis mappers and the controller.

HIGH

7.1

0.2%

56

PoC

CVE-2026-108700

Missing authorization in 1Panel-dev CordysCRM before 1.9.2 lets any authenticated low-privileged user read organization invoicing entities by sending POST /field/source/business-title, an endpoint that performs no permission check and therefore ignores the CONTRACT_BUSINESS_TITLE_READ privilege. Successful exploitation exposes tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers of customer organizations, giving an attacker a ready-made dataset for invoice fraud, business email compromise, and social engineering. Publicly available exploit code exists (a Python PoC published on GitHub), and the issue is confirmed fixed in 1.9.2; per the CVSS:4.0 vector (PR:L, no UI, network-reachable), the practical barrier is simply holding valid low-privilege credentials, so an insider or a compromised standard account is enough to pull the data.

HIGH

7.1

0.2%

56

PoC

CVE-2026-77521

Command injection in MaxKB before 2.10.5-lts allows unauthenticated remote attackers to execute arbitrary shell commands when an assistant is configured with a tool, MCP tool, skill, or sub-application. Untrusted chat messages or ingested documents can coerce the LLM into invoking the un-gated `execute` shell tool, which lacks human approval and is exposed by the SandboxShellBackend. Both source deployments with MAXKB_SANDBOX disabled and the official root container's vulnerable gosu wrapper permit command execution outside the intended sandbox; no public exploit code or confirmed active exploitation was identified at time of analysis. A vendor patch is available in version 2.10.5-lts.

CRITICAL

10.0

1.0%

51

CVE-2026-63647

CordysCRM before 1.7.2 exposes its SSE notification endpoints anonymously, allowing a remote unauthenticated attacker who can reach the backend HTTP interface to read another user's workflow events, approval requests, mentions, and alerts, inject SYSTEM_HEARTBEAT messages into that user's stream, or close that user's SSE channel. The flaw is missing authentication (CWE-306) in the Shiro public-path whitelist and the controller's trust in a caller-supplied userId; the provided source advisory CVSS 4.0 score is 9.3, while the independent CVSS 3.1 assessment is 8.6 because confidentiality impact is high but integrity and availability impact are limited to a selected user's notification stream. No CISA KEV entry or public exploit code was identified at time of analysis, but exploitation requires only network reachability and a target userId.

CRITICAL

9.3

0.5%

47

CVE-2026-108702

Blind SSRF in CordysCRM through 1.9.3 allows any authenticated user to call POST /approval-flow/webhook/test without the required PROCESS_SETTING permission, causing the server to issue outbound requests to an attacker-supplied URL. An attacker-controlled host can redirect the request to bypass SSRFValidator and use the endpoint's success or failure results to probe internal addresses. Publicly available exploit code exists, and the assessed impact is a low-privilege broken-access-control flaw with only low confidentiality exposure and no confirmed active exploitation.

MEDIUM

5.3

0.2%

47

PoC No patch

CVE-2026-108704

Authorization bypass in CordysCRM through 1.9.3 allows low-privileged authenticated users to add follow-up records and overwrite follow_time and follower on any known customer, clue, or opportunity by setting the owner field to their own user id. Exploitation requires a valid low-privileged account and knowledge of a target record ID; the impact is limited to integrity of follow-up records with no confidentiality or availability effect. Publicly available exploit code exists, though CISA KEV does not list this as actively exploited. This is a moderate-priority authenticated-only vulnerability (CWE-639).

MEDIUM

5.3

0.2%

47

PoC No patch

CVE-2026-108701

Missing authorization in CordysCRM's ContractController sort handler (POST /contract/sort) lets any authenticated user - even one without contract update permission - modify contract records, including contracts belonging to other organizations, by supplying dragNodeId, stage, and field values. The flaw is CWE-862 and affects all versions before 1.9.2; publicly available exploit code exists, though there is no confirmation of active exploitation in CISA KEV. Impact is confined to contract-record integrity (no data disclosure or service disruption), making this a moderate-severity Broken Function Level Authorization issue rather than a critical breach.

MEDIUM

5.3

0.2%

47

PoC

CVE-2026-108705

Authenticated low-privileged users of CordysCRM through 1.9.3 can create or overwrite records inside custom forms they are not permitted to manage, because the POST /custom-form/data/import endpoint never verifies the caller's rights over the submitted customFormId (CWE-862). Exploitation needs only a valid low-privilege session plus an Excel file with importType set to ADD or UPDATE, and publicly available exploit code exists (a PoC script is published on GitHub); however, there is no confirmation of active exploitation (not in CISA KEV). With a CVSS 4.0 base score of 5.3 and impact confined to data integrity, this is a genuine but moderate-priority issue rather than a high-severity emergency.

MEDIUM

5.3

0.2%

47

PoC No patch

CVE-2026-108703

Broken access control in CordysCRM through 1.9.3 allows any authenticated low-privileged user to submit arbitrary business resources for approval by calling POST /approval-resource/push without any ownership check, altering approval status and exposing approval details for contracts, invoices, quotations, and orders. The flaw is remotely reachable with a valid session but requires authentication (PR:L), and impact is bounded to low confidentiality and integrity loss with no availability or system-level effect. Publicly available exploit code exists, including a proof-of-concept script, but there is no confirmation of active exploitation, and no vendor-released patch was identified in the available data at time of analysis.

MEDIUM

5.3

0.2%

47

PoC No patch

CVE-2026-79916

Authenticated workspace members on MaxKB deployments prior to 2.10.5-lts can escalate to root-level command execution by abusing how the AWS Bedrock provider stores credentials. Because MaxKB writes user-supplied access_key_id and secret_access_key values into /root/.aws/credentials without proper parsing, an attacker can smuggle control characters and a forged [profile] block containing a credential_process directive, then trigger a later model-validation request that makes botocore run an attacker-controlled command as root. Exploitation requires valid workspace credentials, the reachable Bedrock provider configuration path, and a two-step inject-then-trigger sequence on a service running with root privileges; vendor-released patch 2.10.5-lts is available and no public exploit identified at time of analysis.

CRITICAL

9.1

0.3%

46

CVE-2026-77523

Cross-workspace read and modification of model parameter defaults in MaxKB 2.10.3-lts and earlier is possible for an authenticated user who holds model-read permission in a workspace they control, simply by supplying a model_id that belongs to a victim workspace. The model parameter form route checks authorization against the workspace in the URL path, but the underlying ModelSerializer.ModelParams fetches the Model by id alone without filtering on workspace_id, so the object-level check is bypassed (CWE-639, CVSS 3.1 base 7.4, AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L). Impact is bounded: it is limited to reading or overwriting the victim's model_params_form, which can indirectly alter the default behavior of workflows that consume that model, and practical exploitation requires a multi-tenant deployment plus knowledge or guessing of a valid victim model_id; no public exploit identified at time of analysis and no fixed version is available as of this review.

HIGH

7.4

0.2%

37

No patch

CVE-2026-63646

Unauthenticated information disclosure in CordysCRM (1Panel-dev) versions prior to 1.7.2 lets any network-reachable caller retrieve CRM form metadata via GET /mcp/form/config/{formKey}, exposing field names, types, required flags, default values, options, validation rules, and binding sources. The flaw exists because ShiroFilter marks the /mcp/** path as anonymous and McpController.getMcpField carries no permission annotation, so the endpoint is reachable without credentials (CVSS 4.0 base 6.9; independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Impact is limited to schema/metadata disclosure rather than direct access to customer records, and no public exploit code has been identified at time of analysis; exploitation does require knowledge or brute-forcing of valid formKey identifiers.

MEDIUM

6.9

0.5%

35

CVE-2026-76900

CordysCRM 1.7.3 and earlier allows an authenticated user holding the PROCESS_SETTING_ADD permission to store an attacker-chosen webhook URL in an approval-flow node and then cause the server to issue outbound HTTP requests to that URL when an approval action is approved, turning the application into a proxy for reaching internal-only services. The assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - high confidentiality impact against the attacked component with no integrity or availability impact - and the practical payoff is cloud metadata access (for example 169.254.169.254) and internal network reconnaissance, bounded by the server's network reach and by the multi-step trigger (configure via POST /approval-flow/add, fire via POST /approval-action/approve). The flaw is fixed in 1.7.4 per vendor advisory GHSA-fg6q-pfj7-fghw, PR #2966 and commit e0ae23e; no public exploit code and no confirmed active exploitation were identified at time of analysis, and exploitation requires a low-privileged authenticated account plus a second in-application approval step.

MEDIUM

6.8

0.4%

34

No patch

CVE-2026-79917

Broken authorization in MaxKB 2.7.0 through 2.10.4-lts lets an attacker who holds any valid chat token turn a victim's private conversation into a public ChatShareLink and create PublicFileAccess state that makes associated files retrievable without credentials. The POST /chat/api/{application_id}/chat/{chat_id}/share_chat handler verifies only that the conversation exists, never that it belongs to the caller's chat_user_id or to the application bound to the caller's token (CWE-285), and the exposure cannot be undone through the product because there is no revoke path. No public exploit identified at time of analysis and no vendor-released patch exists as of this review; the assessed CVSS 3.1 base score is 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N), with high attack complexity reflecting the need to know a specific, generally non-enumerable victim chat_id rather than any weakness in the request itself.

MEDIUM

6.5

0.2%

33

No patch

CVE-2026-79919

MaxKB releases prior to 2.10.6-lts allow an authenticated workspace member who can author and run function-library (tool) code to escape the built-in LD_PRELOAD syscall sandbox and act with the sandbox OS user's privileges, reading or writing files, spawning processes, and reaching networks that the sandbox was meant to block. The escape works because the sandbox's dlopen guard relied on a call-stack heuristic that can be satisfied from an importlib.abc.MetaPathFinder callback while loading ctypes, after which the real glibc syscall can be resolved with dlsym/RTLD_NEXT and invoked outside the interception layer. This is a protection-mechanism failure (CWE-693) rather than conventional unauthenticated RCE; the vendor-published score is 6.3, but the assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H because once the sandbox is defeated the escaped user's file, process, and network access is fully available. No public exploit was identified at time of analysis, and the issue is fixed in 2.10.6-lts.

MEDIUM

6.3

0.3%

32

Severity Breakdown

Monthly CVE Trend

Affected Products (5)

Top Risky CVEs