Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-63647

CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

CVSS 4.0 9.3 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-63647

Published

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-63647

Published

CordysCRM

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "1Panel-dev",
                    "product": "CordysCRM",
                    "versions": [
                        {
                            "version": "< 1.7.2",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON