CVE-2026-76902 Overview
CordysCRM is an open-source AI-powered customer relationship management (CRM) system supporting private deployment. CVE-2026-76902 is a missing authentication vulnerability [CWE-306] affecting CordysCRM versions prior to 1.7.4. The ShiroFilter configuration marks the /attachment/preview/{id} and /pic/preview/{id} routes as anonymous. Both routes call AttachmentService.getResource, which performs a bare primary-key lookup without ownership, organization, or permission checks. Unauthenticated callers who guess or observe an identifier generated by IDGenerator.nextStr can retrieve files uploaded by users belonging to other organizations. The vendor addressed the issue in version 1.7.4.
Critical Impact
Unauthenticated attackers can download attachments across organizational boundaries by supplying valid resource identifiers to public preview endpoints.
Affected Products
- CordysCRM versions prior to 1.7.4
- Deployments exposing /attachment/preview/{id} endpoints
- Deployments exposing /pic/preview/{id} endpoints
Discovery Timeline
- 2026-09-18 - CVE-2026-76902 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-76902
Vulnerability Analysis
The vulnerability resides in CordysCRM's Shiro-based authorization filter chain. The ShiroFilter explicitly designates /attachment/preview/{id} and /pic/preview/{id} as anonymous endpoints, bypassing session authentication. When either route is invoked, control passes to AttachmentService.getResource, which resolves the attachment strictly by primary key. The retrieved record contains an organization identifier, but that identifier is used only to locate the underlying file on disk. It is never compared against the caller's session, tenant, or permission context. Consequently, any identifier accepted by the lookup returns the corresponding file content to the requester.
Because CordysCRM supports multi-organization private deployment, this behavior collapses tenant isolation for stored attachments. Documents, images, and any other files handled by the attachment subsystem can be exfiltrated by an outside party who obtains a valid identifier.
Root Cause
The root cause is a missing authorization check in the attachment retrieval flow. AttachmentService.getResource treats resource ownership as a lookup key rather than an access-control assertion. Combined with anonymous filter rules for the two preview routes, no layer of the request pipeline enforces that the caller has rights to the requested attachment.
Attack Vector
The attack is executed over the network without prior authentication. An attacker issues HTTP GET requests to /attachment/preview/{id} or /pic/preview/{id} using identifiers produced by IDGenerator.nextStr. Because nextStr produces predictable or observable identifiers in typical usage, attackers can enumerate values or capture them through referrers, logs, or shared links. Successful requests return the raw file content associated with the identifier, regardless of the requesting party's organization.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-93p7-j9r5-jc7q and the fixing commit for technical detail on the corrected logic.
Detection Methods for CVE-2026-76902
Indicators of Compromise
- Unauthenticated HTTP GET requests to /attachment/preview/{id} or /pic/preview/{id} originating from external or unexpected IP ranges.
- High-volume sequential or randomized enumeration of attachment identifiers against the two preview endpoints.
- Successful 200 OK responses to preview routes without an associated authenticated session cookie or token.
Detection Strategies
- Review web server and reverse-proxy access logs for requests to the affected routes lacking authenticated session context.
- Correlate download volume per client IP against baseline traffic to identify enumeration attempts.
- Alert on cross-organization access patterns where a single source retrieves attachments tied to multiple tenant identifiers.
Monitoring Recommendations
- Enable structured logging for the CordysCRM attachment subsystem, including resource identifiers and resolved organization IDs.
- Forward CordysCRM and reverse-proxy logs to a centralized analytics platform for retention and correlation.
- Track file egress volume from the CordysCRM host to detect bulk exfiltration attempts.
How to Mitigate CVE-2026-76902
Immediate Actions Required
- Upgrade CordysCRM to version 1.7.4 or later, which introduces authorization checks in AttachmentService.getResource.
- Restrict inbound access to the CordysCRM instance to trusted networks until the upgrade is complete.
- Audit access logs for prior requests to /attachment/preview/{id} and /pic/preview/{id} to identify potential data exposure.
Patch Information
The vendor released a fix in CordysCRM v1.7.4. The corrective change is applied in pull request #2978 and the associated commit 3d1f68b, which enforce ownership and organization checks before returning attachment content.
Workarounds
- Place /attachment/preview/{id} and /pic/preview/{id} behind an authenticating reverse proxy that requires a valid session before forwarding requests.
- Remove the anonymous designation for these routes in the ShiroFilter configuration and require authenticated access.
- Rotate or regenerate attachment identifiers after upgrading if exposure is suspected, to invalidate any identifiers previously harvested by attackers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
