vciy-2026-0006 · 1Panel-dev/CordysCRM · CWE-862

Incomplete fix for CVE-2026-108692: missing permission and scope checks in CordysCRM field source handlers

Verification of commit a31fa16fb2dc86ab6b0fdc1ee58a204af424f38d (fixing CVE-2026-108692) identified sibling endpoints in CordysCRM's field resolution and reference lookup layer that remained accessible without module read permission or data-scope enforcement.

Receipt & provenance · vciy-2026-0006

Advisory ID

vciy-2026-0006canonical vciy advisory identifier

Upstream project

1Panel-dev/CordysCRMJava (Maven)

Affected versions

CordysCRM <= v1.9.4verified on upstream default branch

Weakness class

CWE-862Missing Authorization

Related CVE records

CVE-2026-108692upstream fix commit inspected

Upstream tracking

GHSA-cf47-36cc-qj3f (private upstream triage)reported 2026-10-22 · Coordinated disclosure in progress

Credit

Jonathan Corners (@JCorners68), Voxell, Inc. (https://vciy.com)discovered and reported

Record CVE-2026-108692 as mitigated Open CVE-2026-108692 evidence page All vciy advisories

Root cause and sibling analysis.

When form-field helper endpoints delegate to domain services without @RequiresPermissions annotations, each helper route must enforce the underlying module's read permission and organization/department data scope before returning entity lists or reference details.

Detailed endpoint names, service methods, and a remediation diff have been filed privately with the upstream maintainers under GHSA-cf47-36cc-qj3f via GitHub Private Vulnerability Reporting. Full technical details will be published on this page once an upstream release is available.

Remediation.

Upgrade to the patched CordysCRM release once published under GHSA-cf47-36cc-qj3f.