Threats tagged 'ghsa-p6fp-39mj-m4hm'

1Panel-dev CordysCRM versions before 1.9.2 have a missing authorization vulnerability in the ContractController's sortModule handler for the POST /contract/sort endpoint. This flaw allows authenticated users without contract update permissions to modify any contract, including those belonging to other organizations, by supplying specific parameters. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3.