CVE-2026-108705: Missing Authorization in 1Panel-dev CordysCRM

CordysCRM through version 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint. This flaw allows authenticated users with low privileges to import Excel files specifying importType as ADD or UPDATE, enabling them to create new records or overwrite existing records in any custom form by referencing its customFormId, even if they do not have management rights over those forms. This vulnerability arises from insufficient authorization checks on the import functionality.

An attacker with low-level authenticated access can manipulate data in custom forms they are not authorized to manage. This can lead to unauthorized data creation or modification, potentially compromising data integrity within the affected application. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. In the meantime, restrict access to the import functionality to trusted users only and consider additional access controls or monitoring around the affected endpoint.