1panel-Dev Cordyscrm
18 CVEs affecting 1panel-Dev Cordyscrm. Latest disclosed: 2026-10-11. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-76900 | Medium | 6.8 | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.send… |
CVE-2026-108700 | Medium | 6.5 | 2026-10-11 | 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field… |
CVE-2026-108692 | Medium | 6.5 | 2026-10-11 | 1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints… |
CVE-2026-16223 | Medium | 6.3 | 2026-07-19 | A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/s… |
CVE-2026-16222 | Medium | 6.3 | 2026-07-19 | A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/i… |
CVE-2026-76901 | Medium | 5.8 | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in Poo… |
CVE-2026-76899 | Medium | 5.7 | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/pag… |
CVE-2026-108703 | Medium | 5.4 | 2026-10-11 | CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource f… |
CVE-2026-52745 | Medium | 5.3 | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page en… |
CVE-2026-76902 | Medium | 5.0 | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attach… |
CVE-2026-108705 | Medium | 4.3 | 2026-10-11 | CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import… |
CVE-2026-108704 | Medium | 4.3 | 2026-10-11 | CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the… |
CVE-2026-108702 | Medium | 4.3 | 2026-10-11 | 1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger ser… |
CVE-2026-108701 | Medium | 4.3 | 2026-10-11 | 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which la… |
CVE-2026-10567 | Low | 3.5 | 2026-06-02 | A security vulnerability has been detected in 1Panel-dev CordysCRM up to 1.4.1. This impacts the function Save of the file src/main/java/cn/cordys/crm/system/s… |
CVE-2026-10514 | Low | 2.4 | 2026-06-02 | A vulnerability has been found in 1Panel-dev CordysCRM up to 1.6.2. This affects an unknown function of the file backend/framework/src/main/java/cn/cordys/conf… |
CVE-2026-63647 | | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anon… | |
CVE-2026-63646 | | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey}… |