CVE-2026-108704 — CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to the…
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to add follow-up records and overwrite follow_time and follower on any known customer, clue or opportunity.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7