CordysCRM before version 1.7.2 has a missing authentication vulnerability (CWE-306) in its SseController. The SSE endpoints /sse/subscribe, /sse/broadcast, and /sse/close are publicly accessible due to permissive path filters in ShiroFilter.addPublicPathFilters. These endpoints trust the userId provided by the caller rather than deriving it from an authenticated principal. Consequently, an unauthenticated attacker can subscribe to another user's event stream, inject SYSTEM_HEARTBEAT messages into their stream, or close their SSE channel. This flaw is resolved in version 1.7.2.

An unauthenticated attacker can access sensitive user-specific workflow events, approval requests, mentions, and alerts by subscribing to another user's SSE stream. They can also inject misleading heartbeat messages or forcibly close another user's SSE connection. This compromises confidentiality and availability of user event streams, potentially disrupting user workflows and causing denial of service.

Upgrade CordysCRM to version 1.7.2 or later, where this vulnerability is fixed. The fix involves enforcing authentication on the SSE endpoints and deriving user identity from authenticated principals rather than caller-controlled parameters. No other mitigation is indicated by the vendor advisory.