{"id":"CVE-2026-126496","summary":"1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id}","details":"1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read permission can request GET /account/contact/get/{id} with another contact's ID to obtain names, phone numbers, owners, departments, linked customers and custom fields.","modified":"2026-11-14T07:04:29.732616140Z","published":"2026-11-11T00:58:49.598Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126496.json"},"references":[{"type":"ADVISORY","url":"https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.9.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126496.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126496"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/1panel-dev-cordyscrm-before-1.9.6-authorization-bypass-via-account-contact-get-id"},{"type":"REPORT","url":"https://github.com/1Panel-dev/CordysCRM/issues/3891"},{"type":"FIX","url":"https://github.com/1Panel-dev/CordysCRM/commit/a48c6587216810bfad20b398585a51c41842184e"},{"type":"PACKAGE","url":"https://github.com/1Panel-dev/CordysCRM"},{"type":"ARTICLE","url":"https://github.com/1Panel-dev/CordysCRM/blob/v1.9.5/backend/crm/src/main/java/cn/cordys/crm/customer/controller/CustomerContactController.java#L96-L102"},{"type":"ARTICLE","url":"https://github.com/1Panel-dev/CordysCRM/blob/v1.9.5/backend/crm/src/main/java/cn/cordys/crm/customer/service/CustomerContactService.java#L220-L226"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/1panel-dev/cordyscrm","events":[{"introduced":"0"},{"fixed":"16ce39f7e90fbd002d32b1231e46d6988dadaa65"},{"fixed":"a48c6587216810bfad20b398585a51c41842184e"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"1.9.6"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"fixed":"a48c6587216810bfad20b398585a51c41842184e"}],"source":"REFERENCES_COMMIT"},{"original_tag":"v1.9.6","range":[{"fixed":"16ce39f7e90fbd002d32b1231e46d6988dadaa65"}],"source":"REFERENCES_TAG"}]}}],"versions":["v1.9.4","v1.9.3","v1.9.2","v1.9.1","v1.9.0","v1.8.1","v1.8.0","v1.7.2","v1.7.1","v1.7.0","v1.6.2","v1.6.1","v1.6.0","v1.5.2","v1.5.1","v1.5.0","v1.4.1","v1.4.0","v1.3.3","v1.3.2","v1.3.1","v1.3.0"],"database_specific":{"vanir_signatures_modified":"2026-11-14T07:04:29Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126496.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["251641967153751362667856843458808577632","81093659890492000023276416182162219093","96726375640312230130686725950163616028","134844392660073571881763223214151216513"],"threshold":0.9},"id":"CVE-2026-126496-0d067da2","signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/opportunity/service/OpportunityQuotationService.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/a48c6587216810bfad20b398585a51c41842184e","target":{"function":"preparePermissionChain","file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/CustomerContactPermissionTest.java"},"deprecated":false,"digest":{"function_hash":"1988650163891522890891834381631694613","length":3614},"id":"CVE-2026-126496-25bcec62"},{"digest":{"length":300,"function_hash":"232654582804344969145917901768193053560"},"id":"CVE-2026-126496-27ad86f3","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/contract/service/ContractPaymentRecordService.java","function":"getSimple"},"deprecated":false},{"deprecated":false,"digest":{"length":356,"function_hash":"247236044334337193265719535571929849807"},"id":"CVE-2026-126496-2a9446a4","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/form/service/CustomFormDataService.java","function":"getSimple"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/contract/service/ContractService.java","function":"getSimple"},"deprecated":false,"digest":{"function_hash":"88686445800197284989110970485503474729","length":346},"id":"CVE-2026-126496-3c72183f"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/contract/service/ContractPaymentRecordService.java"},"deprecated":false,"digest":{"line_hashes":["210310707666961230460415490574196567920","77349849232479959779531731543729359846","233005197276166258434331532175399753825","230265391772726440653768974830730626205"],"threshold":0.9},"id":"CVE-2026-126496-47b06854"},{"source":"https://github.com/1panel-dev/cordyscrm/commit/a48c6587216810bfad20b398585a51c41842184e","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/service/CustomerContactService.java"},"deprecated":false,"digest":{"line_hashes":["70138283245774725149859546355387370200","123153664050407793236748356311710146141","58771914308736905329353218390603281283","268750612112982348296099566100294082711","224427301372202855634717201326618068278","144639285788025645360405840597052530708","202087643006492594861373314430739793701","83004295376823989539798757850971324365","58182659674530219065299141529266604758","21079477114463386924968250601666972539","268340239621565376428328791642153735440","256867290323077990154344125578502540089","233168761257168459413357382047398624490","138712624635870077386165490755266483682","284116821490894209681899120115630402820","195774978733417160301889543720612487261","90870408403547185666108185413412394323","88054107087261920899287672502662050786","195276190576071363609448687087639856373"],"threshold":0.9},"id":"CVE-2026-126496-4d28a8aa","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-126496-67d56382","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/opportunity/service/OpportunityQuotationService.java","function":"getSimple"},"deprecated":false,"digest":{"function_hash":"253434064668967584635859161213040565063","length":370}},{"deprecated":false,"digest":{"line_hashes":["126109685429743905154586559613488664461","150687066177410868787888585706333732248","330792689107887368721974242587076620687","67426409265596642088055291199592227998"],"threshold":0.9},"id":"CVE-2026-126496-7b1d487c","signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/contract/service/ContractService.java"}},{"source":"https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/form/service/CustomFormDataService.java"},"deprecated":false,"digest":{"line_hashes":["235669124551360499889602659561641774369","311911391158592046130882593931603228239","283421529936700144144244928538219082254","308516437272704417701572246833986392811"],"threshold":0.9},"id":"CVE-2026-126496-a2a5e06a","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/a48c6587216810bfad20b398585a51c41842184e","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/CustomerContactPermissionTest.java"},"deprecated":false,"digest":{"line_hashes":["110404434598548062569001506988208091531","167962886056354630373178520610903712830","251254956345356025244985250564198313291","318787101179723633027313491092142618588","272591278366550995307052136531547298643","312309618355541564137491496980864442373","307574441991646360334842782313285325029","164078376273905861048013035909785757659","180347532077233720969017044725918455427","76732429576768216272793296243456080055","334538951401935971037535539004527903","90504692741397366651383688015239335317","37867774354711552030789614648420651794","298853738469663771372312142454084971923","197594581382001608349571071621524362900","323177947377516597077858458729621386660","151661470926450784710637906854842160612","169039385173972138216366131461408408931","154333339320023207114535340912962981961","264622743188036616056370076496817644055","75573494534926540207675200113775942278","33938100493596707008586848172827030781","249191408796769995130946360644720415538","188537869043737264039342580651159425325","235941909153265609671420908017484623954","295682247759969974101691485279807237793","297600195168120569887048862955095658665","4666260045070821400087165937325322044","20235928318059453475932026381002023493","212334268764409085345736557416466360320","334626718128162394493781111971492229290","213711894789236755812859843302897699353","255997536351704446883550531691263779172","177166351929699084218785665904365676854","292830975881282443794174483178734264533","119068217116500499191541963152869632561","12648646181551484088786729345664612814","190946437200465584085742060058663484456","235447171437822458371433564847020396975","281355487382783288059120565591455289529"],"threshold":0.9},"id":"CVE-2026-126496-b4778fff"},{"target":{"function":"get","file":"backend/crm/src/main/java/cn/cordys/crm/customer/service/CustomerContactService.java"},"deprecated":false,"digest":{"function_hash":"317776444073330961693518466572052924923","length":1437},"id":"CVE-2026-126496-cfb6e029","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/a48c6587216810bfad20b398585a51c41842184e"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/order/service/OrderService.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["316331985981578636661090446196931175461","299886928870729606377595901475206090510","18551769895340155574234846866589938736","111188138405156965703373131595825642582"]},"id":"CVE-2026-126496-dcc4fce2"},{"digest":{"function_hash":"75976602199296718655283419517630623745","length":340},"id":"CVE-2026-126496-e021978e","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/order/service/OrderService.java","function":"getSimple"},"deprecated":false}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}