CVE-2026-63647: critical vulnerability in 1Panel-dev CordysCRM
CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.5%
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
1Panel-dev · CordysCRMRelated CVEs — 1Panel-dev CordysCRM
In the same product, most dangerous first.
CVE-2026-63646MEDIUMCordysCRM MCP Form Configuration Endpoint Exposed to Anonymous UsersEPSS 0.7%CVE-2026-76900MEDIUMCordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at RuntimeEPSS 0.5%CVE-2026-76901MEDIUMCordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accountsEPSS 0.4%CVE-2026-76899MEDIUMCordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`EPSS 0.4%CVE-2026-16223MEDIUM1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgeryEPSS 0.4%CVE-2026-16222MEDIUM1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgeryEPSS 0.4%