CVE-2026-108705: CordysCRM Auth Bypass Vulnerability

CVE-2026-108705 Overview

CVE-2026-108705 is a missing authorization vulnerability [CWE-862] in CordysCRM through version 1.9.3. The flaw resides in the POST /custom-form/data/import endpoint, which fails to validate whether the authenticated caller is permitted to manage the target custom form. Any low-privileged user can submit an Excel file referencing an arbitrary customFormId and specify importType=ADD or importType=UPDATE. The server processes the import against custom forms the user cannot otherwise manage, creating or overwriting records at will.

Critical Impact

Authenticated low-privileged users can inject or overwrite records in custom forms they do not own, undermining data integrity across the CRM.

Affected Products

• CordysCRM through 1.9.3
• 1Panel-dev CordysCRM backend crm module
• CustomFormDataController import handler

Discovery Timeline

• 2026-10-11 - CVE-2026-108705 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108705

Vulnerability Analysis

The vulnerability is a broken access control defect in the custom form data import pipeline. CordysCRM exposes POST /custom-form/data/import, which accepts a customFormId parameter alongside an uploaded Excel payload. The controller delegates to CustomFormDataService to parse rows and either add or update records in the referenced form. The import handler authenticates the session but does not verify that the caller has management rights on the targeted form. As a result, authorization is enforced only in the user interface and in form-management endpoints, not in the import pathway.

An authenticated attacker with the lowest privilege tier can enumerate customFormId values and submit crafted Excel files to tamper with any form in the tenant. Because the import supports both ADD and UPDATE modes, attackers can inject fraudulent rows or overwrite existing records, including records in forms that store sales pipeline data, customer contacts, or workflow state.

Root Cause

The root cause is a missing authorization check in CustomFormDataController and CustomFormDataService. The service trusts the customFormId provided in the request body and executes the import without reconciling it against the caller's permissions on that specific form. See the CustomFormDataController source and CustomFormDataService source for the vulnerable code paths.

Attack Vector

Exploitation requires network access to the CordysCRM web application and valid credentials for any low-privileged account. The attacker issues a multipart POST request to /custom-form/data/import with a target customFormId, an importType of ADD or UPDATE, and an Excel file matching the target form's schema. No user interaction and no administrative role is required. A working proof of concept is published at the CordysCRM PoC repository.

Detection Methods for CVE-2026-108705

Indicators of Compromise

• Unexpected POST /custom-form/data/import requests originating from user accounts that do not own the referenced customFormId.
• Bulk INSERT or UPDATE events against custom form tables correlated with import API calls outside normal business hours.
• Multipart requests uploading .xls or .xlsx payloads with importType=ADD or importType=UPDATE from accounts that lack form management roles.

Detection Strategies

• Enable application-level audit logging for all requests to /custom-form/data/import and record the authenticated user, customFormId, and importType values.
• Correlate custom form record changes with the user identity that triggered the import, flagging mismatches between the modifier and the form owner.
• Baseline normal import frequency per user and alert on sudden spikes or imports targeting forms the user has never previously accessed.

Monitoring Recommendations

• Forward CordysCRM application and web server logs to a centralized analytics platform for cross-user correlation.
• Monitor database audit trails for mass record creation or modification on tables backing custom forms.
• Review authentication logs for brute-force or credential-stuffing activity targeting low-privileged accounts that could be weaponized against this endpoint.

How to Mitigate CVE-2026-108705

Immediate Actions Required

• Restrict network access to the CordysCRM backend to trusted administrative users until a patched release is deployed.
• Audit custom form records for unauthorized additions or modifications and roll back changes attributed to accounts without management rights on the affected forms.
• Rotate credentials for low-privileged accounts and enforce multi-factor authentication to raise the bar for exploitation.

Patch Information

As of the NVD last-modified date (2026-10-14), the VulnCheck advisory identifies all versions through 1.9.3 as affected. Monitor the upstream 1Panel-dev CordysCRM repository for a fixed release that introduces an authorization check binding customFormId to the caller's form management permissions.

Workarounds

• Deploy a reverse proxy or web application firewall rule that denies POST /custom-form/data/import requests from users not in an administrative role.
• Temporarily disable the custom form import feature at the application or gateway layer if business operations permit.
• Implement a server-side authorization filter that validates customFormId ownership before the request reaches CustomFormDataController.

# Example WAF rule to block imports from non-admin sessions
# (adjust role claim name to match your deployment)
SecRule REQUEST_URI "@streq /custom-form/data/import" \
  "id:1082026,phase:1,deny,status:403,\
   chain,msg:'Block CordysCRM custom form import for non-admins'"
  SecRule REQUEST_HEADERS:X-User-Role "!@streq admin"