Skip to content
Sign in
5.3 Medium

CVE-2026-126496 1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id}

Description

1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read permission can request GET /account/contact/get/{id} with another contact's ID to obtain names, phone numbers, owners, departments, linked customers and custom fields.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Exploitable remotely over the network, with an ordinary account and without any user action; the impact on data or service is limited.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
Low
Interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
CordysCRM 1.9 earliest → < 1.9.6 1.9.6

Other CVEs of CordysCRM

The 19 CVEs of CordysCRM →
CVE-2026-108705 CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint… 5.3 Medium CVE-2026-108704 CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to… 5.3 Medium CVE-2026-108703 CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows… 5.3 Medium CVE-2026-108702 1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test,… 5.3 Medium
Track this CVE