Threats tagged 'ghsa-9hfx-wfh9-xc9r'

CVE-2026-108705 is a missing authorization vulnerability in CordysCRM through version 1.9.3. It affects the POST /custom-form/data/import endpoint, allowing authenticated users with low privileges to import data into any custom form by specifying the customFormId. Attackers can upload Excel files with importType ADD or UPDATE to create or overwrite records in custom forms they are not authorized to manage. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity.