Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-63646

CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

CVSS 4.0 6.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-63646

Published

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey} calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/** as anonymous and the controller has no permission annotation. An unauthenticated caller can obtain field names, types, required flags, default values, options, validation rules, and binding sources for CRM modules, allowing reconstruction of the application data model and more targeted attacks against other inputs. This issue is fixed in version 1.7.2.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-63646

Published

CordysCRM

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "1Panel-dev",
                    "product": "CordysCRM",
                    "versions": [
                        {
                            "version": "< 1.7.2",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON