---
id: CVE-2026-76902
title: >-
  CordysCRM is an open source AI-powered customer relationship management system
  that supports private deployment
summary: >-
  CordysCRM is an open source AI-powered customer relationship management system
  that supports private deployment. Prior to 1.7.4, ShiroFilter configures
  /attachment/preview/{id} and /pic/preview/{id} as anonymous, and both routes
  call Att…
severity: medium
cvss: 5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L'
cwe:
  - CWE-306
  - CWE-862
vendor: 1Panel-dev
product: CordysCRM
affected:
  - CordysCRM < 1.7.4
published: '2026-09-18'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T17:18:50.513'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76902'
references:
  - url: >-
      https://github.com/1Panel-dev/CordysCRM/commit/3d1f68be0778ce35362688296bf355c1cb2d86fb
    label: security-advisories@github.com
  - url: 'https://github.com/1Panel-dev/CordysCRM/pull/2978'
    label: security-advisories@github.com
  - url: 'https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-93p7-j9r5-jc7q
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T16:31:34.556423Z'
epss: 0.00225
epssPercentile: 0.13398
ingestedAt: '2026-09-18T20:51:25.680Z'
---

## Overview

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attachment/preview/{id} and /pic/preview/{id} as anonymous, and both routes call AttachmentService.getResource, which performs a bare primary-key lookup without ownership, organization, or permission checks. An unauthenticated caller who guesses or observes an id generated by IDGenerator.nextStr can download files uploaded by users in other organizations because the stored organization id is used only to locate the file rather than authorize the caller. This issue is fixed in version 1.7.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.