CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/{id} and /pic/preview/{id} as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key lookup without ownership, organization, or permission checks. An unauthenticated caller who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations because the stored organization id is used only to locate the file rather than authorize the caller. This issue is fixed in version 1.7.4.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey} calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/** as anonymous and the controller has no permission annotation. An unauthenticated caller can obtain field names, types, required flags, default values, options, validation rules, and binding sources for CRM modules, allowing reconstruction of the application data model and more targeted attacks against other inputs. This issue is fixed in version 1.7.2.
CVE-2026-52745 is a medium severity SQL injection vulnerability in CordysCRM versions prior to 1.7.0. It affects the POST /account-pool/page endpoint, allowing an authenticated user with MODULE_SETTING:UPDATE permission to inject crafted input into a dynamic SQL ORDER BY clause without proper validation. This can lead to time-based blind SQL injection, enabling attackers to confirm database expression execution, infer metadata and sensitive data, and cause database delays that degrade service. The issue is fixed in version 1.7.0.
KubePi versions up to and including 1.6.15 have a missing authentication vulnerability in the SSO configuration API endpoints. These endpoints are accessible without administrator authorization, allowing unauthorized or low-privileged users to read, create, or update global SSO settings. This can lead to account takeover or privilege escalation. Additionally, the SSO connectivity-test function can be abused for server-side request forgery, and the user list API leaks authentication-related fields. The issue is fixed in version 2.0.0.
KubePi versions up to and including 2.0.0 have an authorization bypass vulnerability where cluster-scoped APIs do not consistently validate user access per cluster. This allows authenticated users with cluster management permissions to access or modify clusters beyond their assigned scope. The issue is fixed in version 2.0.1.
MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.update_tool passes caller-supplied download_url and download_callback_url values to requests.get without equivalent trusted-host and redirect validation, allowing an authenticated workspace user to make the server request internal, loopback, link-local, or cloud metadata URLs. A fix is present on the v2 branch but has not yet been included in a published release.
A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py and MCP referencing mode in apps/application/chat_pipeline/step/chat_step/impl/base_chat_step.py do not consistently validate MCP transport type, allowing an authenticated user to import a .tool file containing stdio transport with malicious commands and trigger the configuration through an AI Chat node so MultiServerMCPClient executes arbitrary system commands. This issue is fixed in version 2.10.0-lts.
MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by supplying unvalidated downloadCallbackUrl and download_url parameters. Attackers with default workspace USER role can exploit this to access internal network services by providing malicious URLs to the ToolSerializer endpoints.
CVE-2026-10567 is a cross-site scripting (XSS) vulnerability in 1Panel-dev CordysCRM affecting versions up to 1.4.1. The issue occurs in the Save function of the ModuleFormService.java file, where manipulation of the Description argument allows remote attackers to execute XSS attacks. The vulnerability has a medium severity score of 5.1. Upgrading to version 1.7.0 resolves the issue.
CVE-2026-10514 is a cross-site scripting (XSS) vulnerability affecting 1Panel-dev CordysCRM versions 1.6.0 through 1.6.2. The issue exists in an unspecified function within the file backend/framework/src/main/java/cn/cordys/config/RequestParamTrimConfig.java. Remote attackers can exploit this vulnerability. Upgrading to version 1.7.
MaxKB versions 2.8.0 and earlier contain a server-side request forgery (SSRF) bypass vulnerability caused by a time-of-check to time-of-use (TOCTOU) race condition in the OSS file service URL fetch functionality. This occurs due to inconsistent DNS resolution between the validation step and the actual request execution, potentially allowing attackers to access internal network services. The issue is addressed in version 2.8.1. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1.
MaxKB versions 2.8.0 and earlier contain a broken access control vulnerability in the OSS file service URL fetch API endpoint (chat/api/oss/get_url). The endpoint fails to validate ownership of the application_id parameter, allowing unauthorized operations under other applications' policies. This issue is addressed in MaxKB version 2.8.1. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.3.
MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.0, MaxKB's webhook trigger endpoint (/api/trigger/v1/webhook/{trigger_id}) is accessible without authentication. The WebhookAuth class unconditionally returns (None, {}), which Django REST Framework interprets as successful authentication. Combined with optional per-trigger token verification and no backend enforcement of token requirements, any unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers to execute their bound tasks. This vulnerability is fixed in 2.9.0.
CVE-2026-45412 is a Server-Side Request Forgery (SSRF) vulnerability in the open-source AI assistant MaxKB by 1Panel-dev. Versions prior to 2.9.1 allow authenticated users to supply arbitrary URLs via the work_flow_template.downloadUrl parameter, which the server fetches without validation or internal IP filtering. This can lead to unauthorized server-side requests. The vulnerability has a CVSS 4.0 score of 6.3 (medium severity). A fix is available in version 2.