CVE-2026-108692: 1Panel CordysCRM Authorization Bypass Flaw

CVE-2026-108692 Overview

CVE-2026-108692 is a missing authorization vulnerability [CWE-862] in 1Panel-dev CordysCRM versions 1.9.0 through 1.9.1. The flaw affects eight ModuleFieldController/field/source data-source endpoints that lack permission enforcement. Authenticated users without module permission can page through organization-wide records belonging to other users. Exposed data includes leads, contacts, quotations, contracts, payment plans, payment records, orders, and invoices. The vendor fixed the issue in release 1.9.2.

Critical Impact
Any authenticated low-privilege user can enumerate confidential CRM data across the entire organization by querying /field/source endpoints that skip the data-permission check.

Affected Products

1Panel-dev CordysCRM 1.9.0
1Panel-dev CordysCRM 1.9.1
CordysCRM backend cn.cordys.crm.system.controller.ModuleFieldController component

Discovery Timeline

2026-10-11 - CVE-2026-108692 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108692

Vulnerability Analysis

The vulnerability resides in the CordysCRM backend module responsible for returning field data-source lookups. Eight endpoints under /field/source in ModuleFieldController do not apply the DataScopeService permission filter before executing the underlying MyBatis queries. The affected mapper queries, including ExtClueMapper.xml and ExtContractInvoiceMapper.xml, return records across all owners when no dataPermission constraint is present. An authenticated user who has been explicitly denied module access can therefore iterate through the paginated result set and extract organization-wide CRM records.

Root Cause

The root cause is a missing authorization check in the data-source handlers. The DataScopeService component defines an invisible state that the mapper XML files failed to honor. When the condition was absent, SQL execution proceeded without an owner or scope restriction, exposing records belonging to any user.

Attack Vector

Exploitation requires only valid low-privilege credentials in the CordysCRM instance. The attacker sends authenticated HTTP requests to the /field/source endpoints associated with leads, contacts, quotations, contracts, payment plans, payment records, orders, and invoices. By incrementing the pagination parameters, the attacker enumerates records owned by other users. A public proof of concept, poc_field_source_family.py, demonstrates the enumeration pattern.

xml

           and c.owner = #{userId}
         </if>
 
+        <if test="dataPermission != null and dataPermission.invisible">
+            AND 0
+        </if>
+
         <if test="!source and request.keyword != null and request.keyword != ''">
             and (c.name like concat('%', #{request.keyword},'%') or c.phone like concat('%', #{request.keyword},'%'))
         </if>

The patch adds an explicit AND 0 clause when dataPermission.invisible is true, forcing the query to return no rows for unauthorized callers. Source: GitHub Commit a31fa16.

Detection Methods for CVE-2026-108692

Indicators of Compromise

Unexpected HTTP requests from low-privilege accounts to any /field/source endpoint under the CordysCRM backend.
Large volumes of paginated requests originating from a single authenticated session targeting leads, contacts, contracts, or invoice modules.
Access patterns where a user with no assigned module permission retrieves records whose owner differs from their account ID.

Detection Strategies

Review CordysCRM application logs for /field/source requests correlated with user accounts that lack the corresponding module role.
Instrument the ModuleFieldController handlers to log the resolved DataScopeService outcome and alert when invisible users successfully receive non-empty responses.
Deploy web application firewall rules that baseline /field/source request frequency per session and flag anomalous enumeration.

Monitoring Recommendations

Centralize CordysCRM access logs and database audit output in a SIEM for correlation across users, endpoints, and pagination parameters.
Alert on sequential paging requests to multiple /field/source endpoints by the same user within short time windows.
Monitor outbound data volume from the CordysCRM backend host for signs of bulk record exfiltration.

How to Mitigate CVE-2026-108692

Immediate Actions Required

Upgrade CordysCRM to version 1.9.2 or later, which contains the authorization fix.
Audit user and role assignments to confirm that only intended accounts hold CRM module permissions.
Review historical access logs for /field/source requests from users whose roles should have blocked the queries.

Patch Information

The vendor addressed the issue in CordysCRM 1.9.2 via commit a31fa16. The patch introduces a dataPermission.invisible guard across the affected mapper XML files so that unauthorized callers receive no rows. Additional details are available in the VulnCheck Advisory for CordysCRM and the ModuleFieldController source.

Workarounds

Restrict network access to the CordysCRM backend so that only trusted internal users can authenticate.
Disable or rotate credentials for accounts that do not require CRM access until the upgrade is deployed.
Place a reverse proxy rule in front of /field/source endpoints to block requests from users whose session roles lack module permission.

bash

# Upgrade CordysCRM to the patched release
git fetch --tags
git checkout v1.9.2
./mvnw -pl backend/crm -am clean package
systemctl restart cordyscrm