CVE-2026-108692: 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

Deferred

Published 11-10-2026Last modified 14-10-2026

Vulnerability summary

CVE-2026-108692 is a high (CVSS 7.1) Missing Authorization vulnerability in 1panel-dev cordyscrm. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.9% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

7.1/10

010

High · v4.0 (CVE.org)

EPSS score

0.24%

0%100%

Low · Change unavailable

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Timeline

11-10-2026
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users.

CVSS metrics

4 scores · 2 sources · 2 versions

v4.07.1v3.16.5

EPSS trend

Probability

0.24%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

Change unavailable

11-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
Cve Request Poc
Maturity: poc

Weaknesses

CWE · root cause

CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

1panel-dev1 product

cordyscrm≥ 1.9.0, < 1.9.2

1 vendor · 1 product

References

5 links

github.com/AnkesKasty/…Exploit
github.com/1Panel-dev/…Technical Description
github.com/1Panel-dev/…Technical Description
github.com/1Panel-dev/CordysCRM/commit/a31fa16fb2dc86ab6b0fdc1ee58a204af424f38dPatch
www.vulncheck.com/advisories/…Third Party Advisory