CVE-2026-63647: CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

Vulnerability summary

CVE-2026-63647 is a critical (CVSS 9.3) vulnerability in 1panel-dev cordyscrm. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 42.6% of scored vulnerabilities.

Timeline

1. 18-09-2026
   PublishedVulnerability first disclosed.
2. 18-09-2026
   Last modifiedVulnerability information updated.

Description

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.

• CWE-306Missing Authentication for Critical FunctionalityThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.