---
id: CVE-2026-76901
title: >-
  CordysCRM is an open source AI-powered customer relationship management system
  that supports private deployment
summary: >-
  CordysCRM is an open source AI-powered customer relationship management system
  that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in
  PoolClueController.get and GET /pool/account/get/{id} in
  PoolCustomerController.g…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-639
vendor: 1Panel-dev
product: CordysCRM
affected:
  - CordysCRM < 1.7.4
published: '2026-09-18'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T21:17:09.897'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76901'
references:
  - url: >-
      https://github.com/1Panel-dev/CordysCRM/commit/34c7c3e5de2585208744926007530037a4ce4da5
    label: security-advisories@github.com
  - url: 'https://github.com/1Panel-dev/CordysCRM/pull/2976'
    label: security-advisories@github.com
  - url: 'https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-hxp2-5w5p-2grq
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T19:40:07.714553Z'
epss: 0.00332
epssPercentile: 0.2657
ingestedAt: '2026-09-18T20:51:25.679Z'
---

## Overview

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.