Threats tagged 'ghsa-378v-v9jq-pgrf'

CVE-2026-108700 is a missing authorization vulnerability in 1Panel-dev CordysCRM versions before 1.9.2. Authenticated users can call the POST /field/source/business-title endpoint without proper permission checks, allowing them to list business titles and retrieve sensitive organization invoicing data such as tax IDs, bank account numbers, opening banks, registration addresses, and phone numbers. This exposure occurs even if users lack the CONTRACT_BUSINESS_TITLE_READ permission.