CVE-2026-108700 — 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-t…
Published: 2026-10-11 · CVSS: 7.1 · CVSS 4.0
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7