CVE-2026-63647
Severity not reportedCordysCRM is an open source AI-powered customer relationship management system that supports private deployment.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/1Panel-dev/CordysCRM/commit/6cb81deb53434ae7792673c50312ff91685d7f9d security-advisories@github.com
- https://github.com/1Panel-dev/CordysCRM/pull/2719 security-advisories@github.com
- https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.2 security-advisories@github.com
- https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4 security-advisories@github.com
- https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4 134c704f-9b21-4f2e-91b3-4a467353bcc0