CVE-2026-108701 — 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission…
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a dragNodeId, stage and field values to modify any contract, including contracts in other organizations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7