CVE-2026-108704: CordysCRM Authorization Bypass Vulnerability

CVE-2026-108704 Overview

CVE-2026-108704 is an authorization bypass vulnerability [CWE-639] affecting CordysCRM through version 1.9.3. The flaw lives in the follow-up record add endpoints exposed by the Customer, Clue, and Opportunity controllers. Low-privileged authenticated users can skip permission checks by setting the owner field in the request body to their own user id. Once the server trusts that attacker-supplied owner value, the request proceeds to add follow-up records and overwrite the follow_time and follower fields on any known customer, clue, or opportunity record. The weakness undermines record-level access control for CRM data stored in CordysCRM deployments.

Critical Impact
Any authenticated user can tamper with follow-up metadata on customer, clue, and opportunity records they do not own, corrupting CRM data integrity.

Affected Products

CordysCRM through 1.9.3 (backend/crm module)
ClueFollowRecordController add endpoint
CustomerFollowRecordController and FollowUpRecordController add endpoints

Discovery Timeline

2026-10-11 - CVE-2026-108704 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108704

Vulnerability Analysis

CordysCRM exposes several REST endpoints under follow/record/add that allow authenticated users to append follow-up records to customers, clues, and opportunities. The backend controllers accept a request body that includes an owner field. The service layer, implemented in BaseFollowUpService, uses this attacker-controlled owner value when deciding whether the caller is permitted to modify the target record. Because the authorization check compares the submitted owner to the current user id instead of the stored owner of the target entity, any low-privileged user can satisfy the check by sending their own id. The vulnerability maps to Authorization Bypass Through User-Controlled Key [CWE-639] and is a classic Insecure Direct Object Reference pattern. See the VulnCheck Advisory on CordysCRM for the vendor-independent write-up.

Root Cause

The root cause is a trust boundary violation in the follow-up record service. Instead of resolving the owner of the target customer_id, clue_id, or opportunity_id from the database, the controller flow in ClueFollowRecordController, CustomerFollowRecordController, and FollowUpRecordController accepts the client-provided owner field. The shared permission routine in BaseFollowUpService then validates that owner matches the session user, which is trivially true for the attacker.

Attack Vector

An attacker only needs a valid low-privileged account and knowledge or guess of a target record identifier. The attacker sends an authenticated POST request to follow/record/add on the customer, clue, or opportunity controller with the target entity id and their own user id in the owner field. The service appends a new follow-up record and overwrites the follow_time and follower fields on the targeted entity, even though the attacker has no legitimate relationship to it. A proof-of-concept script is published at the GitHub PoC for CordysCRM.

Detection Methods for CVE-2026-108704

Indicators of Compromise

POST requests to paths matching follow/record/add where the request body owner field equals the authenticated session user id but the targeted customer_id, clue_id, or opportunity_id is not owned by that user.
Unexpected changes to follow_time and follower columns on customer, clue, or opportunity rows attributable to users who were never assigned as owners.
Spikes in follow-up record inserts from a single low-privileged account across many unrelated entity ids.

Detection Strategies

Correlate application access logs with the CRM database to flag follow-up writes where the writer is not the stored owner of the parent record.
Add server-side logging that records both the submitted owner value and the resolved database owner for every follow-up add call, then alert when they diverge.
Review audit trails for sequential enumeration of entity ids by a single account, which is characteristic of the public PoC pattern.

Monitoring Recommendations

Ingest CordysCRM application and reverse-proxy logs into a centralized log platform and build queries for /follow/record/add activity grouped by user id.
Monitor database triggers or change-data-capture streams on the follow-up tables to detect writes that bypass the expected ownership relationship.
Alert on any single account that touches follow-up records across more than a defined threshold of distinct entities within a short time window.

How to Mitigate CVE-2026-108704

Immediate Actions Required

Inventory CordysCRM deployments and confirm the running version against 1.9.3 and earlier.
Restrict network exposure of the CordysCRM backend to trusted administrative networks until a fix is applied.
Review follow-up record tables for unauthorized modifications and restore follow_time and follower values from backups where tampering is confirmed.

Patch Information

At the time of publication, the NVD entry for CVE-2026-108704 does not list a fixed version. Monitor the upstream 1Panel-dev/CordysCRM repository and the VulnCheck Advisory on CordysCRM for a vendor release that resolves the authorization check in BaseFollowUpService. Any corrective patch must resolve the target record's owner from the database and ignore the client-supplied owner field.

Workarounds

Apply a reverse-proxy or Web Application Firewall rule that blocks or alerts on requests to follow/record/add endpoints where the body includes an owner field.
Add a server-side filter or interceptor that strips the owner field from inbound JSON payloads before controllers deserialize them.
Temporarily revoke follow-up record add permissions from untrusted roles until the vendor publishes a fix.

bash

# Example NGINX rule to drop requests that include a client-supplied owner field
location ~ ^/.*/follow/record/add$ {
    if ($request_method = POST) {
        access_by_lua_block {
            ngx.req.read_body()
            local body = ngx.req.get_body_data() or ""
            if string.find(body, '"owner"') then
                ngx.exit(403)
            end
        }
    }
    proxy_pass http://cordyscrm_backend;
}