CVE-2026-108692: Missing Authorization in 1Panel-dev CordysCRM

The vulnerability in 1Panel-dev CordysCRM (versions >=1.9.0 <1.9.2) involves missing authorization checks on eight /field/source data-source endpoints within the ModuleFieldController. This allows authenticated users who are denied module permissions to page through sensitive organizational data such as leads, contacts, quotations, contracts, payment plans, payment records, orders, and invoices belonging to other users. The CVSS 4.0 base score is 7.1, indicating a high severity due to network attack vector, low attack complexity, no privileges required beyond authentication, and high impact on confidentiality.

Exploitation of this vulnerability allows unauthorized authenticated users to access sensitive organizational data across multiple modules, potentially leading to data leakage of leads, contacts, financial documents, and contracts. There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints by enforcing strict authorization controls and monitor authenticated user activities for suspicious access patterns.