Medium severity4.3NVD Advisory· Published Nov 11, 2026· Updated Nov 11, 2026
CVE-2026-126496
CVE-2026-126496
Description
1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read permission can request GET /account/contact/get/{id} with another contact's ID to obtain names, phone numbers, owners, departments, linked customers and custom fields.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <1.9.6
Patches
Vulnerability mechanics
References
6- github.com/1Panel-dev/CordysCRM/blob/v1.9.5/backend/crm/src/main/java/cn/cordys/crm/customer/controller/CustomerContactController.javanvd
- github.com/1Panel-dev/CordysCRM/blob/v1.9.5/backend/crm/src/main/java/cn/cordys/crm/customer/service/CustomerContactService.javanvd
- github.com/1Panel-dev/CordysCRM/commit/a48c6587216810bfad20b398585a51c41842184envd
- github.com/1Panel-dev/CordysCRM/issues/3891nvd
- github.com/1Panel-dev/CordysCRM/releases/tag/v1.9.6nvd
- www.vulncheck.com/advisories/1panel-dev-cordyscrm-before-1.9.6-authorization-bypass-via-account-contact-get-idnvd
News mentions
0No linked articles in our index yet.