CVE-2026-108705 is a missing authorization vulnerability in CordysCRM through version 1.9.3. It affects the POST /custom-form/data/import endpoint, allowing authenticated users with low privileges to import data into any custom form by specifying the customFormId. Attackers can upload Excel files with importType ADD or UPDATE to create or overwrite records in custom forms they are not authorized to manage. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity.
CordysCRM versions up to 1.9.3 contain an authorization bypass vulnerability that allows low-privileged authenticated users to bypass permission checks by manipulating the owner field. This enables attackers to add or modify follow-up records on customers, clues, or opportunities via specific endpoints.
CordysCRM versions up to 1.9.3 have a missing authorization vulnerability in the POST /approval-resource/push endpoint. Authenticated users with low privileges can submit arbitrary resource IDs for approval without ownership verification, allowing them to alter approval statuses and read approval details of contracts, invoices, quotations, or orders.
CVE-2026-108702 is a medium severity vulnerability in 1Panel-dev CordysCRM versions up to 1.9.3. It involves a missing authorization check on the POST /approval-flow/webhook/test endpoint, allowing any authenticated user to trigger server-side requests to attacker-controlled URLs. This can be exploited to bypass SSRF validation and probe internal network addresses.
1Panel-dev CordysCRM versions before 1.9.2 have a missing authorization vulnerability in the ContractController's sortModule handler for the POST /contract/sort endpoint. This flaw allows authenticated users without contract update permissions to modify any contract, including those belonging to other organizations, by supplying specific parameters. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3.
CVE-2026-108700 is a missing authorization vulnerability in 1Panel-dev CordysCRM versions before 1.9.2. Authenticated users can call the POST /field/source/business-title endpoint without proper permission checks, allowing them to list business titles and retrieve sensitive organization invoicing data such as tax IDs, bank account numbers, opening banks, registration addresses, and phone numbers. This exposure occurs even if users lack the CONTRACT_BUSINESS_TITLE_READ permission.
1Panel-dev CordysCRM versions from 1.9.0 up to but not including 1.9.2 contain a missing authorization vulnerability. This flaw affects eight ModuleFieldController /field/source data-source endpoints that lack proper permission checks. Authenticated users without module permissions can access and page through organization-wide sensitive data such as leads, contacts, quotations, contracts, payment plans, payment records, orders, and invoices owned by other users.
CVE-2026-79919 is a protection mechanism failure vulnerability in MaxKB, an open-source AI assistant for enterprise. Versions prior to 2.10.6-lts allow an authenticated workspace member to bypass the LD_PRELOAD sandbox syscall blacklist by exploiting a flaw in how ctypes.CDLL is invoked from a MetaPathFinder callback. This enables unauthorized read/write file access, process execution, and network access as the sandbox user. The issue is fixed in version 2.10.6-lts.
MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execveat to prevent subprocess creation but does not hook fexecve. An authenticated attacker able to execute tool code can call fexecve to start a process outside the sandbox's intended subprocess policy. This issue is fixed in version 2.10.6-lts.
CVE-2026-77517 is an authorization bypass vulnerability in 1Panel-dev MaxKB versions 2.0.0 through 2.10.2-lts. The issue arises because the document and paragraph operate routes authorize only the knowledge_id in the request path but do not verify that the document or paragraph actually belongs to that knowledge base. This allows a user with access to a known document or paragraph UUID to read or modify content in another user's knowledge base by using an attacker-controlled knowledge base path. No fixed version is currently available.
CVE-2026-77521 is a critical OS command injection vulnerability in MaxKB, an open-source AI assistant for enterprise. Versions prior to 2.10.5-lts allow untrusted input to execute shell commands without human approval due to improper sandboxing and command execution controls. This can lead to full system compromise by executing arbitrary commands as the application user. The issue is fixed in version 2.10.5-lts.
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body is converted into imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server. No fixed version is available as of this review.
CVE-2026-79917 is an improper authorization vulnerability in MaxKB versions 2.7.0 through 2.10.4-lts. The flaw allows an attacker with any valid chat token and knowledge of a victim's chat ID to create a public share link for the victim's conversation without verifying ownership. This also enables unauthorized public access to associated files with no way to revoke access. No patch or fix is currently available.
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through tool_ids, skill_tool_ids, or mcp_tool_ids and execute it through the agent or workflow dispatch path. The dispatch path does not reapply the per-tool grant enforced by dedicated tool routes, and tool execution decrypts server-side init_params, allowing the caller to receive credentials carried by the denied tool. No fixed version is available as of this review.
CVE-2026-77523 is an authorization bypass vulnerability in MaxKB, an open-source AI assistant for enterprise. In versions 2.10.3-lts and earlier, the model parameter form route authorizes access based on workspace path, but the underlying ModelSerializer.ModelParams loads and saves models by ID alone without verifying workspace ownership. This allows an authenticated user with read permission in an attacker-controlled workspace to access or modify model parameters in other workspaces by supplying a victim's model ID. No patch or fixed version is currently available.
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load records using global chat_id and chat_record_id values without confirming that the chat belongs to the authorized application. A normal user in the same workspace who knows the chat_id of a persisted non-debug record for a victim's published application can place it under a separate attacker-owned application path to read victim chat records. An attacker with an owned knowledge base and document can also use add_knowledge to copy victim answers while updating the victim record's improve_paragraph_id_list. No fixed version is available as of this review.
CVE-2026-77518 is a missing authorization vulnerability in MaxKB, an open-source AI assistant for enterprise. In versions 2.10.2-lts and earlier, a normal workspace user can access hidden tools of other users within the same workspace by knowing the tool's MCP tool_id. This occurs because the tool-detail route lacks per-resource authorization checks, unlike the list route. The exposed tool details include Tool.code, which may contain sensitive MCP server configuration and headers. Additionally, an attacker who can create or edit workflows can misuse another user's MCP configuration by referencing their tool_id in a workflow node without permission verification. No fix is currently available for this issue.
CVE-2026-79916 is a critical OS command injection vulnerability in MaxKB, an open-source AI assistant for enterprise. Authenticated workspace members prior to version 2.10.5-lts can inject control characters into AWS credentials fields, leading to execution of attacker-controlled commands as root. The vulnerability is fixed in version 2.10.5-lts.
CVE-2026-77520 is a missing authorization vulnerability in MaxKB, an open-source AI assistant for enterprise. In versions 2.10.2-lts and earlier, a normal user within the same workspace can obtain another user's application_id via the homepage application question-ranking endpoint under certain conditions. This identifier can then be exploited by creating a workflow application node that references the victim's application, allowing the attacker to trigger workflows that generate output and create persistent chat records under the victim's application. No official fix or patch is available as of the review date.
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the standard chat API. A previously valid, non-permanent application key that remains active after expiration can initialize the MCP endpoint, list the published application's tool metadata, invoke tools/call, and create durable application_chat and application_chat_record state even though /chat/api/open rejects the same key. No fixed version is available as of this review.