CVE-2026-76899: CordysCRM SQL Injection Vulnerability

CVE-2026-76899 Overview

CordysCRM is an open-source AI-powered customer relationship management (CRM) system that supports private deployment. A SQL injection vulnerability [CWE-89] affects versions 1.7.0 through 1.7.3. The POST /account-pool/page endpoint accepts an unvalidated sort parameter that flows into an ORDER BY clause. An authenticated caller holding the MODULE_SETTING_UPDATE privilege can place arbitrary database functions in SortRequest.name to trigger an error-based SQL injection. Attackers can use functions such as extractvalue and updatexml to extract database contents through error oracles. The issue is fixed in version 1.7.4.

Critical Impact
Authenticated attackers with MODULE_SETTING_UPDATE privileges can extract sensitive database contents through error-based SQL injection when the underlying query returns at least one row.

Affected Products

CordysCRM version 1.7.0
CordysCRM versions 1.7.1 through 1.7.3
Fixed in CordysCRM version 1.7.4

Discovery Timeline

2026-09-18 - CVE CVE-2026-76899 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-76899

Vulnerability Analysis

The vulnerability resides in the CustomerPoolController.page handler that services POST /account-pool/page. The controller omits Spring request validation, allowing arbitrary content in the SortRequest object. The SortRequest.getName method applies a denylist intended to block SQL injection payloads, but the list is incomplete. The CommonMapper.xml sort fragment then interpolates the attacker-controlled sortName value directly into an ORDER BY clause using MyBatis ${} substitution. Because ${} performs string replacement rather than parameter binding, the input becomes part of the compiled SQL statement.

Attackers substitute XPath-style functions such as extractvalue and updatexml for a legitimate column name. These functions are not covered by the denylist and force the database to evaluate attacker-controlled expressions. When the expression contains a syntax error crafted to include subquery output, the database returns the extracted value inside the error message, forming an error oracle. This requires the base query to return at least one row for the sort clause to be evaluated.

Root Cause

Three defects combine to create the vulnerability: missing Spring bean validation on the request DTO, an incomplete blacklist inside SortRequest.getName, and the use of unsafe ${sortName} interpolation in CommonMapper.xml. Any one of these controls, if implemented correctly, would have prevented exploitation.

Attack Vector

An authenticated caller with the MODULE_SETTING_UPDATE role sends a crafted POST /account-pool/page request. The sort.name field carries a payload built around extractvalue or updatexml that references a subquery selecting sensitive data. The server executes the resulting SQL, and the injected function raises an error containing the exfiltrated value. Refer to the GitHub Security Advisory GHSA-x6p7-vhgp-6r3q for full technical details.

Detection Methods for CVE-2026-76899

Indicators of Compromise

HTTP POST requests to /account-pool/page containing the substrings extractvalue(, updatexml(, or other XML-related SQL functions in the sort.name parameter.
Database error log entries referencing XPATH syntax error originating from CordysCRM query execution.
Repeated 500-series responses from the /account-pool/page endpoint tied to a single authenticated session with MODULE_SETTING_UPDATE privileges.

Detection Strategies

Inspect application and web server logs for anomalous sort parameters that contain SQL function syntax rather than plain column names.
Enable MyBatis SQL logging in non-production environments to correlate rendered ORDER BY clauses with inbound requests.
Deploy web application firewall (WAF) rules that flag SQL keywords appearing in sort or order parameters across JSON bodies.

Monitoring Recommendations

Monitor privileged accounts holding MODULE_SETTING_UPDATE for abnormal request rates against pagination endpoints.
Alert on database error events referencing XPath functions when the source is the CordysCRM service account.
Track outbound data volumes from the CordysCRM database host to identify sustained extraction attempts.

How to Mitigate CVE-2026-76899

Immediate Actions Required

Upgrade CordysCRM to version 1.7.4 or later, which fixes the vulnerability.
Audit user role assignments and reduce the number of accounts granted MODULE_SETTING_UPDATE.
Rotate database credentials if logs indicate suspicious activity against /account-pool/page.

Patch Information

The fix is delivered in CordysCRM v1.7.4. The corrective changes were merged in Pull Request #2975 with commits 3e6a700 and b217166. The patches add server-side validation to reject arbitrary values in the sort parameter and harden the mapper against unsafe interpolation.

Workarounds

If patching is delayed, restrict network access to the /account-pool/page endpoint using a reverse proxy allowlist.
Deploy a WAF rule that blocks requests to CordysCRM containing SQL function names within sort or order fields.
Temporarily revoke the MODULE_SETTING_UPDATE permission from non-essential users until the upgrade is complete.

bash

# Example WAF rule fragment to block SQL functions in sort parameters
SecRule REQUEST_URI "@beginsWith /account-pool/page" \
  "chain,deny,status:403,id:1076899,msg:'CVE-2026-76899 SQLi attempt'"
  SecRule REQUEST_BODY "@rx (?i)(extractvalue|updatexml|xmltype)\s*\(" "t:none"