Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-1087001Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title

Medium 6.5

In plain English

A medium-severity missing authorization in CordysCRM from 1Panel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 85.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can retrieve organization invoicing entities, exposing tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers.

Affected products (as reported)

Vendor	Product	Versions
1Panel-dev	CordysCRM	0 – before 1.9.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Researcher Proof of Concept exploit
Vulnerable Code (v1.9.1) technical-description
Fix Commit (v1.9.2) patch
VulnCheck Advisory: 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title third-party-advisory