{"id":"CVE-2026-76901","summary":"CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts","details":"CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4.","aliases":["GHSA-hxp2-5w5p-2grq"],"modified":"2026-09-20T14:13:56.504125Z","published":"2026-09-18T19:55:16.527Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76901.json"},"references":[{"type":"WEB","url":"https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4"},{"type":"ADVISORY","url":"https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-hxp2-5w5p-2grq"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76901.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76901"},{"type":"FIX","url":"https://github.com/1Panel-dev/CordysCRM/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"type":"FIX","url":"https://github.com/1Panel-dev/CordysCRM/pull/2976"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/1panel-dev/cordyscrm","events":[{"introduced":"0"},{"fixed":"34c7c3e5de2585208744926007530037a4ce4da5"},{"fixed":"83bd0bf7422c0391af6c2f798f62c624a056bf6b"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.7.4"}]}}],"versions":["v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.6.2","v1.6.1","v1.6.0","v1.5.2","v1.5.1","v1.5.0","v1.4.1","v1.4.0","v1.3.3","v1.3.2","v1.3.1","v1.3.0"],"database_specific":{"vanir_signatures":[{"id":"CVE-2026-76901-0a7d67d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java","function":"createPickRule"},"deprecated":false,"digest":{"function_hash":"236522838509542512797473307434147467390","length":372}},{"digest":{"line_hashes":["13848738090332839408333930343557301546","184178719509864260159069695227719821349","283994517521815669523892263793462963162","305829752335125088064714332491820339759","299825275263027906968890305921372534535","333367736956555580890348606906191967687","192816064804338699085949980103304394363","116753171242454737678315893271982260046","17039080364180661244229057763382687729","329008562128013794432607145191802075291","86729615264053788659869882973498869987","245717019108317909333475656189707888276","39798656819947043461681115650212324555","2760957885934971392255428996473904455","10518702740964770887593880842467860522","137482833149205635880686061749881332332","113002369107675112957607868829425739576","84600210451915961871519035055466370234","141425654298382446580361134712337050167","317587099304494962274448724073639056664","52685741425362077791396071587746387364","131515767733917361434861851824542813765","17357855258562380967652937330652973212","293908924593339441545298983008169856128","39412705159515738231876697949011450496","158208834530883566992233279873798913241","315251353961361701100140771814728583114","44537269101344391757703725276633404409","215844072245526107682459172294664899772","87240664006760545027454582231244624580","241012470527213200614732478614584469609","47067977309394508151268366000279347527","60370879583003808747318228524914275666","170386045053747012885573121783453439964","281270712782463348223499999104960576058","221331356035127468717325759405210762822","54570407493306803169175248946439864943","157462917448050251896013588855211123216","76532815200504941151610657608338167552","204255238219496593620904105739119179468","19270850080153415847758134746112312696","231448129498923824851847213638794092238","56296042243158829879524590389434313932","309667351998425839197040069500920839426","63442883934726103137810794538419535306","339321393174637651547607778882526816164","16063977131393802988452143862622154434","222640897610571246932714688006231724068","243692116641837522840873453422578284168","198919735405642894289360801838856173246","130317011498114096515939060233085580274","102922425438077856697110949965985517124","306074808065968268290720543645170535466","377003702489782703408202229471522515","54501905465865186203317353750538752019","208602174546008605903143588817196391323","276396303993557808998715504360132479532","214819059629768248447186283271586788595","302651134952703570782836009503459517143","92574199328220254756397583593269886685","145230483238184949053896906695745266216","314383548596621947350587642915009706106","108296216350374315728984625178819537037","176892050032617767513134131762638446464","276435466147817065642271378728280671443","89971347865651449058244765449704555321","65716006848966205032797133049412637524","295923717825346675024096430237663886056","163275035720462297680705212768778947295","88446307461630185285590375210790866896","73023722945989110586249245161995121603","146813322131636070929595488595923038589","245082855496443073197338171910586553235","304048357620216225831834139114573265529"],"threshold":0.9},"id":"CVE-2026-76901-0d5ae180","signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java"},"deprecated":false},{"source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"pick"},"deprecated":false,"digest":{"function_hash":"247805433015393001312534680642650420690","length":166},"id":"CVE-2026-76901-1574f5e1","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"201769393570587072556648191545341872320","length":3087},"id":"CVE-2026-76901-32d7bb4b","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/service/PoolCustomerService.java","function":"getPoolOptions"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java","function":"batchDeleteSuccess"},"deprecated":false,"digest":{"function_hash":"213401919767839790413013759793090088658","length":250},"id":"CVE-2026-76901-35a19ba2","signature_type":"Function"},{"digest":{"function_hash":"292798410393552237876853615354545856846","length":438},"id":"CVE-2026-76901-399481e5","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java","function":"batchAssignFailWithNotExit"},"deprecated":false},{"source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java","function":"batchDeleteSuccess"},"deprecated":false,"digest":{"function_hash":"24310659596535141221183362092753599857","length":220},"id":"CVE-2026-76901-451e282c","signature_type":"Function","signature_version":"v1"},{"target":{"file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java","function":"assignSuccess"},"deprecated":false,"digest":{"function_hash":"82673762171859174990885005906623628156","length":244},"id":"CVE-2026-76901-48da005b","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["310319214403462864406749850499542674715","95637553897885096828379260897994602973","267074912434199031348264420409627044293","260050111207340050422071997688215493581","96266704733093137066130245977102937043","99914139808872567089438281240452311508","41476120754097678455109568411126265524","157562351324187170033125242562782052879","12971301483517125761071548806838753078","64232746123780566998374897832018813017","104708731160307383684950080080706055987","312383667942467745492517200340118177623","228977824741285247603413882865477387496","229594277570311846930208410874425730837","152005122999086181260990175812804684910","105290572085374463982938810529351899117","10518702740964770887593880842467860522","104245406734840665445416628854882555599","117781528718025299165320099187437753954","146053545682001205372979610686660205272","137482833149205635880686061749881332332","329201903256939269488004184464494234714","90122351700689423485330620829409914758","83635246239877309928401975799079701714","284619059098474593609296587428877792728","248306591474707720787916247247712884269","47545173545249753924970241199765951186","20371734525570831127473619730191028968","51299474482839667533462365124351537337","39412705159515738231876697949011450496","75228987512411216042788556723460592494","6481051347609266771027473524130859505","197944791770645229621946938240377287382","251470274422079075406062705306096167797","19272488055617640109430435716109415450","69252675271759314519457474783125244028","209231541033874781158292498993966073556","37416120438867906391298466088680516879","321136274777042370466215142879159137132","325411649078557400814723224820107785692","18776921389222042804045996632718983893","157626246431794857029098948302135491386","2061970345773244139227374883617949577","39136577993354377951326595124330975551","250505881427391080815641458451144405986","223539779864289380818935949008399028882","252100050875381517510174311050943420251","189923543894664027861620473413704411448","201486247531269325409985300258846960744","234996932979952311632396292685622074148","9859614747013614200130251490051179239","117763744737981574770386981152145265784","23176773630060709996124193950102310598","91618503622799903125416604901198233843","102922425438077856697110949965985517124","100294955256468385778327744604780020025","274814294705085131311019929747583972607","20529648997495345227064036491239329835","326784190705139122950965573474069815848","202633868375647090997451203747438113431","324278692285603154121100159687442511767","160118355289219647251098102703547586013","169541672241333371196079042891664238065","54501905465865186203317353750538752019","111506369885196766792621397982399357148","42451299597241923298205575002536028702","313481904380390654921088100786346043157","249562592420123209485013640206785094958","233520649699963665071893965871143493317","257387244810254875063744853689600393237","94007296836757556641020032332179520265","224307999516801385205241529897487495411","212450174585299981822182199569658394466","43306538511169907904875774969951244561","339387811233771828687001002036851217530","245082855496443073197338171910586553235","304048357620216225831834139114573265529"]},"id":"CVE-2026-76901-4f568860","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"delete"},"deprecated":false,"digest":{"function_hash":"78338167672696802600228120855675761263","length":88},"id":"CVE-2026-76901-52e9365e","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"39533916842503152756071232438386619179","length":732},"id":"CVE-2026-76901-55987fc8","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java","function":"pickFailWithOverCapacity"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"delete"},"deprecated":false,"digest":{"function_hash":"61639875815489191972206543488321874720","length":92},"id":"CVE-2026-76901-60d6a620"},{"digest":{"function_hash":"108646649797873003698062458144155567954","length":299},"id":"CVE-2026-76901-6408684e","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java","function":"prepareTestData"},"deprecated":false},{"digest":{"function_hash":"237224285205321804862883412507948359168","length":594},"id":"CVE-2026-76901-659a99e2","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java","function":"batchPickFailWithOverDailyOrPreOwnerLimit"},"deprecated":false},{"digest":{"line_hashes":["128841636036280899014933205245552789431","61899691071485560621731698649138955741","49494271850354406966387354846162307569","127232147084434518550109744341192913113","101549279956925005570977346808601184697","294617784401948048236346219038269067237","113287804611347332040317867436587960038","164577380041815927719460294998589965121","129080229857183031115029840399186383257","214937700170430058392133117658036950341","181896565417686621848741689650768124038"],"threshold":0.9},"id":"CVE-2026-76901-685ed874","signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/service/PoolCustomerService.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"257096696335737193703032516611092256910","length":170},"id":"CVE-2026-76901-68866179","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"batchUpdate"}},{"deprecated":false,"digest":{"function_hash":"249814189414866014824652590306184665645","length":95},"id":"CVE-2026-76901-6c3ffd28","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"get"}},{"target":{"file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java","function":"createPickRule"},"deprecated":false,"digest":{"function_hash":"236522838509542512797473307434147467390","length":372},"id":"CVE-2026-76901-6d5a543a","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"batchDelete"},"deprecated":false,"digest":{"function_hash":"232230020303360344895445649077754824655","length":185},"id":"CVE-2026-76901-6db15114","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-76901-6f531f6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java","function":"batchPickFailWithOverDailyOrPreOwnerLimit"},"deprecated":false,"digest":{"length":578,"function_hash":"77717599826620231237421741924638747633"}},{"target":{"file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java","function":"pickFailWithOverCapacity"},"deprecated":false,"digest":{"function_hash":"95845157196813559956692231909653454709","length":748},"id":"CVE-2026-76901-8260eddc","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"target":{"file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java","function":"createCustomer"},"deprecated":false,"digest":{"function_hash":"292156832230025715906593991440845407508","length":457},"id":"CVE-2026-76901-84e4cb79","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"id":"CVE-2026-76901-867e534f","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/service/PoolClueService.java","function":"getPoolOptions"},"deprecated":false,"digest":{"function_hash":"250998711305133699533735843319888851828","length":3109}},{"signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"exportAll"},"deprecated":false,"digest":{"function_hash":"241241777508211321460018221105563976296","length":631},"id":"CVE-2026-76901-870d3515","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"chart"},"deprecated":false,"digest":{"function_hash":"173739337492906917709600892269299001258","length":184},"id":"CVE-2026-76901-886697d9"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"pick"},"deprecated":false,"digest":{"function_hash":"257096696335737193703032516611092256910","length":170},"id":"CVE-2026-76901-8c5d3606"},{"deprecated":false,"digest":{"function_hash":"333113137469949884488840325916853491613","length":193},"id":"CVE-2026-76901-8de19d9c","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"batchAssign"}},{"deprecated":false,"digest":{"length":208,"function_hash":"151201358742953828769874840884341231255"},"id":"CVE-2026-76901-92765905","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"assign"}},{"target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"exportSelect"},"deprecated":false,"digest":{"function_hash":"301598515387173984769046313638097193122","length":591},"id":"CVE-2026-76901-98252196","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"get"},"deprecated":false,"digest":{"function_hash":"30226335026900900084872757582045615435","length":91},"id":"CVE-2026-76901-9d0dbb73","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"330305505393254738171354294692052757700","length":1003},"id":"CVE-2026-76901-9d70f49d","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"function":"testExport","file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java"}},{"deprecated":false,"digest":{"function_hash":"65650321240422455698074021067301331702","length":601},"id":"CVE-2026-76901-a095fce7","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"customerPoolExportSelect"}},{"id":"CVE-2026-76901-a0d3af45","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"batchAssign"},"deprecated":false,"digest":{"function_hash":"220308264193050173466155464049909209889","length":189}},{"target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"list"},"deprecated":false,"digest":{"function_hash":"164381558575411272706038815511580762037","length":394},"id":"CVE-2026-76901-a11e466f","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"list"},"deprecated":false,"digest":{"function_hash":"152888698106396682533420301678478915534","length":390},"id":"CVE-2026-76901-aef0ee90"},{"signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java","function":"prepareTestData"},"deprecated":false,"digest":{"function_hash":"107652263606614537455451760224215265079","length":291},"id":"CVE-2026-76901-b2d2a23b","signature_type":"Function"},{"target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"batchPick"},"deprecated":false,"digest":{"function_hash":"247805433015393001312534680642650420690","length":166},"id":"CVE-2026-76901-b346f4d7","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"deprecated":false,"digest":{"line_hashes":["32786354791444728017991213588405127795","206673824334608522410734558077394242332","106091610675381695145943272218168862870","16693993996899684498761765220888936215","80450655342367294562617436887854927480","320411219716299147058245227345521898435","250985657001293160026702855051190527637","290794907096190000592760818098315325075","115435765898910987556665109578992177304","301426687344180108370375591032681682415","141096676927476041902970452905569389096","336126493098066323296424566685050069129","148844330985340806285722047258013956237","75996088182925528737185700050472935187","264455724160572284318031039280257050964","36446353500723282827407269325692827893","335236918728852024239147965072442890061","241468949107859605656570329122377179239","251495978328260209258213201310304658118","324674109938545373725577888409200006119","216665213931458566058982602784983359154","338078857976118404230951179698743613014","261827260659141568912443970729861105541","229650141097076896823228226997687590325","155050981013176673884636307501287446028","163420435706616511202974456026959720459","228183128490129219741109172679762351145","258764874965626373375170976958677864471","296866045889016134199367109792054663743","196923062613050714302325752460546599044","30835500620064595122108524640461710703","62405846086223983519028729407407396855","71805443048839235538861985391011254991","93281066134114854539592568614610398212","146534965232476879881329793437499051938","258123936908954989352948288450760994453","256773444426362580360321953611245739183","99223550122584296484125751518864312841","186189780870371428248343841115635680537","84906937867924632731452220191812611644","176256069388432149352403785468542180259","199042854355076065576282486364766484514","107263652564259908127935890659463143694","29430404802151930228871869949807273105","106490554709210538454275720555696875153","40273684230189121618910953523564073701","140978398266052533701672041054632502685","165465102291688347544632018746590035028"],"threshold":0.9},"id":"CVE-2026-76901-b3dd5bbe","signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java"}},{"source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"batchDelete"},"deprecated":false,"digest":{"function_hash":"222537375913978947286416360117028382019","length":165},"id":"CVE-2026-76901-b4550bdd","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java","function":"page"},"deprecated":false,"digest":{"function_hash":"238304101259911992327117988839120819315","length":355},"id":"CVE-2026-76901-bcab4fbd","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/83bd0bf7422c0391af6c2f798f62c624a056bf6b","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/follow/service/BaseFollowUpService.java"},"deprecated":false,"digest":{"line_hashes":["297035554684689859976900268137718555754","170303434073081179366561086831023795378","45846805413225389400126786608722788331","137435120986061611741588412491777321525","269534725956125332894559569595136165384","117988473800182647043574568235015816399"],"threshold":0.9},"id":"CVE-2026-76901-c81882a1","signature_type":"Line"},{"source":"https://github.com/1panel-dev/cordyscrm/commit/83bd0bf7422c0391af6c2f798f62c624a056bf6b","target":{"function":"checkRecordPermission","file":"backend/crm/src/main/java/cn/cordys/crm/follow/service/BaseFollowUpService.java"},"deprecated":false,"digest":{"function_hash":"320144658412324829475839133206321393830","length":1596},"id":"CVE-2026-76901-c823bc9d","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"100165439640477155414682722566882595406","length":186},"id":"CVE-2026-76901-cc78ef11","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"chart"}},{"target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"customerPoolExportAll"},"deprecated":false,"digest":{"function_hash":"168941621957135736311013978142897276179","length":645},"id":"CVE-2026-76901-cd43e9eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"digest":{"line_hashes":["116128689766381682241757482072104525033","294012826135894056623145314994974751891","153860345141689137011270779073715407852","245013220503742386802959462701391837607","218965486142645533972296897685261362218","327762393964692459596560875407686761425","117342932305020592366423814260640948753","145411034071276379492241061688570720635","264868012190150989171033119738548382493","258235575424311965824843514918504888691","69337779408551572087213781698988419161"],"threshold":0.9},"id":"CVE-2026-76901-d41187dc","signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/service/PoolClueService.java"},"deprecated":false},{"digest":{"function_hash":"247805433015393001312534680642650420690","length":166},"id":"CVE-2026-76901-e28cd25b","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"batchUpdate"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["211040325749955499446412246474343960282","193551733463637534220049461905526164464","318304362229214252634744744529004216645","325541540388841619979814671570097478822","25267317502738967276638889033190928552","274671039111205503445703922293243040502","263925186288525051750093685445042437843","176828356382887648172777905637260129198","320667485605774270738561828482537235822","324222640628085985155442592709631565786","126125197428154560588457221726476360709","257369889250059617815556908327542776331","34073689478033392939851480836990648022","207976615787629531533693469471467301493","313558095793495886088044788648105725793","266907704991888332450938561331898438584","76658942006510928857371679549926793458","134406612618118363691211172651626788193","129352806636591160604979806272614625577","155422498188230994781454612337462539731","333626186390116051136828553863515644111","208660263321775192624314119409316766869","209890380452387961218077919335956298634","148159877768910468553448606787577858135","193592930607130544914920017582379454921","218165278750556815299362895878433294247","192025476820901182290847352058883179398","338116966867617032830245698571461758174","26427709454439300460511470084332364747","270733555290217727372326047501003702736","323729754830518450343497126921629934454","266389197576860063793595161495226112052","330421221941629508105916297494502845993","164728109023496805976069530989644139696","83313957029158867649852040177363681194","165963914210716769071041120381252340239","61575831860814798302926618591412235005","162596175034470568116199977978170958924","178975703412546947475912198730191888567","268699248729333139397449590870640052755","155445561592265287182554480790339706715","180410479710712553591248440909465540840","37146301393491445769222166959172202494","262630556126348162179374574910035069727","88744220622910015846046076811108090203","271372951424938247668358581396061775587","149041826033492345046822389130897775274","15049766729993416937370815809848320"],"threshold":0.9},"id":"CVE-2026-76901-e5928c0e","signature_type":"Line","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java"}},{"source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java","function":"createClue"},"deprecated":false,"digest":{"function_hash":"309855224336350406137020008833299111079","length":531},"id":"CVE-2026-76901-e7205994","signature_type":"Function","signature_version":"v1"},{"target":{"file":"backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java","function":"batchPick"},"deprecated":false,"digest":{"function_hash":"257096696335737193703032516611092256910","length":170},"id":"CVE-2026-76901-e9645efa","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"target":{"file":"backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java","function":"page"},"deprecated":false,"digest":{"function_hash":"102782835202913461847355570152967075061","length":351},"id":"CVE-2026-76901-ec41638e","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5"},{"deprecated":false,"digest":{"function_hash":"195326069403074871668355998989428208906","length":240},"id":"CVE-2026-76901-f3239a63","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java","function":"assignSuccess"}},{"id":"CVE-2026-76901-f6e00aa6","signature_type":"Function","signature_version":"v1","source":"https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5","target":{"file":"backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java","function":"assign"},"deprecated":false,"digest":{"length":204,"function_hash":"162046586244841311711558285291701253639"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76901.json","vanir_signatures_modified":"2026-09-20T14:13:56Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N"}]}