CVE-2026-63646: CordysCRM Information Disclosure Vulnerability

CVE-2026-63646 Overview

CordysCRM is an open-source AI-powered customer relationship management (CRM) system that supports private deployment. Versions prior to 1.7.2 expose the GET /mcp/form/config/{formKey} endpoint without authentication. The ShiroFilter.addPublicPathFilters method marks /mcp/** as anonymous, and McpController.getMcpField lacks any permission annotation. An unauthenticated remote attacker can retrieve field names, types, required flags, default values, options, validation rules, and binding sources for CRM modules. This information enables reconstruction of the application data model and more targeted attacks against other inputs. The issue is fixed in version 1.7.2.

Critical Impact

Unauthenticated remote attackers can enumerate the CRM data model, exposing field schemas that facilitate targeted follow-on attacks against CordysCRM deployments.

Affected Products

• CordysCRM versions prior to 1.7.2
• 1Panel-dev CordysCRM (open-source AI-powered CRM)
• Private deployment installations exposing /mcp/** endpoints

Discovery Timeline

• 2026-09-18 - CVE CVE-2026-63646 published to NVD
• 2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-63646

Vulnerability Analysis

The vulnerability is an information disclosure issue [CWE-200] in the CordysCRM MCP (Model Context Protocol) controller. The getMcpField handler returns detailed form metadata for any CRM module by formKey. Because no authentication or authorization check runs against these requests, any network-reachable client can query the endpoint. Returned metadata includes field names, data types, required flags, default values, option lists, validation rules, and binding sources. Attackers use this schema to craft precise injection payloads, business-logic bypasses, and parameter tampering attempts against authenticated endpoints.

Root Cause

Two independent defects combine to expose the endpoint. First, ShiroFilter.addPublicPathFilters explicitly registers /mcp/** with the anon filter, telling Apache Shiro to skip authentication. Second, the McpController.getMcpField method carries no @RequiresPermissions or equivalent annotation. Neither the framework filter nor the controller enforces access control, leaving the endpoint fully public.

Attack Vector

Exploitation requires only network access to the CordysCRM HTTP interface. An attacker issues a GET /mcp/form/config/{formKey} request with any known or guessed formKey value. No credentials, tokens, or user interaction are required. The response returns the internal form schema in structured form, ready for automated parsing.

// Patch: backend/framework/src/main/java/cn/cordys/security/ShiroFilter.java
        FILTER_CHAIN_DEFINITION_MAP.put("/organization/settings/third-party/get/**", "anon");
        FILTER_CHAIN_DEFINITION_MAP.put("/organization/settings/third-party/sync/resource", "anon");
        FILTER_CHAIN_DEFINITION_MAP.put("/license/validate/**", "anon");
-        FILTER_CHAIN_DEFINITION_MAP.put("/mcp/**", "anon");
-        FILTER_CHAIN_DEFINITION_MAP.put("/opportunity/stage/get", "anon");
    }

Source: GitHub Commit ea8d5f1. The fix removes the two overly permissive anonymous filter mappings so Shiro enforces authentication on /mcp/** and /opportunity/stage/get.

Detection Methods for CVE-2026-63646

Indicators of Compromise

• Unauthenticated HTTP GET requests to /mcp/form/config/ paths in application access logs
• Sequential or enumeration-style access to multiple formKey values from a single source IP
• Requests to /mcp/** endpoints originating from external or unexpected IP ranges prior to any login event

Detection Strategies

• Review reverse proxy and application logs for GET /mcp/form/config/* requests lacking a valid session cookie or authorization header
• Correlate /mcp/** access patterns with subsequent parameter-manipulation or injection attempts against other CRM endpoints
• Baseline normal internal MCP traffic and alert on external source addresses accessing these routes

Monitoring Recommendations

• Enable verbose access logging on the CordysCRM web tier, capturing full request URIs and source IPs
• Forward web and application logs to a centralized analytics platform for retention and correlation
• Alert on high-volume formKey enumeration or 200-OK responses to /mcp/** from unauthenticated sessions

How to Mitigate CVE-2026-63646

Immediate Actions Required

• Upgrade CordysCRM to version 1.7.2 or later, which removes the anonymous filter mapping for /mcp/**
• Audit historical access logs for prior unauthenticated requests to /mcp/form/config/ and assess data model exposure
• Restrict network exposure of CordysCRM management interfaces to trusted networks and VPN clients only

Patch Information

The fix is available in CordysCRM v1.7.2. The corrective change is delivered via Pull Request #2725 and commit ea8d5f1, which removes the anon designation from /mcp/** and /opportunity/stage/get. Additional details are published in GHSA-46p5-m7pq-82hm.

Workarounds

• Block external access to /mcp/** at a reverse proxy or web application firewall until the upgrade is applied
• Manually edit ShiroFilter.java to remove the FILTER_CHAIN_DEFINITION_MAP.put("/mcp/**", "anon") entry and rebuild the application
• Place the CordysCRM instance behind an authenticating gateway that enforces session validation before requests reach the application

# Nginx example: block unauthenticated MCP paths at the reverse proxy
location ~ ^/mcp/ {
    allow 10.0.0.0/8;      # trusted internal network
    deny  all;
    proxy_pass http://cordyscrm_backend;
}