Description
1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read permission can request GET /account/contact/get/{id} with another contact's ID to obtain names, phone numbers, owners, departments, linked customers and custom fields.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| 1Panel-dev | CordysCRM | < 1.9.6 | 1.9.6 |
References
- https://github.com/1Panel-dev/CordysCRM/issues/3891 issue-tracking
- https://github.com/1Panel-dev/CordysCRM/commit/a48c6587216810bfad20b398585a51c41842184e patch
- CordysCRM v1.9.6 Release Notes release-notes
- https://github.com/1Panel-dev/CordysCRM/blob/v1.9.5/backend/crm/src/main/java/cn/cordys/crm/customer/controller/CustomerContactController.java#L96-L102 technical-description
- https://github.com/1Panel-dev/CordysCRM/blob/v1.9.5/backend/crm/src/main/java/cn/cordys/crm/customer/service/CustomerContactService.java#L220-L226 technical-description
- https://github.com/1Panel-dev/CordysCRM product
- VulnCheck Advisory: 1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id} third-party-advisory