CVE-2026-108701

MEDIUM 4.3

1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations.

CWE	CWE-862
Vendor	1panel-dev
Product	cordyscrm
Published	Oct 11, 2026

Stay Ahead of the Next One

Get instant alerts for 1panel-dev cordyscrm

Be the first to know when new medium vulnerabilities affecting 1panel-dev cordyscrm are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

1Panel-dev / CordysCRM

0 < 1.9.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_contract_sort_write_bfla.py github.com: https://github.com/1Panel-dev/CordysCRM/blob/a0ef69d31fd98c338199579353840f34ef679197/backend/crm/src/main/java/cn/cordys/crm/contract/controller/ContractController.java#L279-L283 github.com: https://github.com/1Panel-dev/CordysCRM/commit/98e2615569b402063bc02f369274a05f40217d6e vulncheck.com: https://www.vulncheck.com/advisories/1panel-dev-cordyscrm-before-1.9.2-missing-authorization-via-post-contract-sort

Credits

Yaqi Chao