Threats tagged 'ghsa-5qf6-4wf6-7g7c'

1Panel-dev CordysCRM versions from 1.9.0 up to but not including 1.9.2 contain a missing authorization vulnerability. This flaw affects eight ModuleFieldController /field/source data-source endpoints that lack proper permission checks. Authenticated users without module permissions can access and page through organization-wide sensitive data such as leads, contacts, quotations, contracts, payment plans, payment records, orders, and invoices owned by other users.