CVE-2026-108700Published
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108700 · Microsoft / collected KEV context
cve-program · CVE-2026-108700
- https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_field_source_family.py
- https://github.com/1Panel-dev/CordysCRM/blob/a0ef69d31fd98c338199579353840f34ef679197/backend/crm/src/main/java/cn/cordys/crm/system/controller/ModuleFieldController.java#L253-L257
- https://github.com/1Panel-dev/CordysCRM/commit/a31fa16fb2dc86ab6b0fdc1ee58a204af424f38d
- https://www.vulncheck.com/advisories/1panel-dev-cordyscrm-before-1.9.2-missing-authorization-via-field-source-business-title
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.