Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-1086921Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

Medium 6.5

In plain English

A medium-severity missing authorization in CordysCRM from 1Panel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organization-wide leads, contacts, quotations, contracts, payment plans, payment records, orders and invoices owned by other users.

Affected products (as reported)

Vendor	Product	Versions
1Panel-dev	CordysCRM	1.9.0 – before 1.9.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Researcher Proof of Concept exploit
Vulnerable Code (v1.9.1) technical-description
Data Scope Invisible Flag (v1.9.1) technical-description
Fix Commit (v1.9.2) patch
VulnCheck Advisory: 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints third-party-advisory