CVE-2026-108705 1Panel-dev CVE debrief

Who should care

Defenders and administrators of CordysCRM systems should assess exposure, especially in environments where low-privileged users have access to the affected endpoint. They should verify if their systems are using vulnerable versions and implement necessary mitigations.

Why it matters

CVE-2026-108705 is a missing authorization vulnerability in CordysCRM that allows low-privileged users to import data into custom forms they cannot manage, potentially leading to unauthorized data imports and overwrites. Defenders should prioritize verifying exposure, restricting access to the affected endpoint, and monitoring for suspicious data imports.

• Potential unauthorized data imports by low-privileged users
• Risk of data overwrite or creation in custom forms without proper authorization
• Need for verification of CordysCRM version and custom form configurations
• Potential impact on data integrity and system security

Technical summary

The vulnerability exists in the POST /custom-form/data/import endpoint of CordysCRM through version 1.9.3. It allows authenticated users to import data into any custom form by customFormId, enabling low-privileged attackers to upload Excel files with importType ADD or UPDATE to create or overwrite records in custom forms they cannot manage. This could lead to unauthorized data imports and overwrites, potentially impacting data integrity and system security. Defenders should prioritize verifying exposure of CordysCRM custom forms to unauthorized data imports, especially in systems where low-privileged users have access to the POST /custom-form/data/import endpoint.

Defensive priority

Defenders should prioritize verifying exposure of CordysCRM custom forms to unauthorized data imports, especially in systems where low-privileged users have access to the POST /custom-form/data/import endpoint.

Recommended defensive actions

• Verify CordysCRM version and custom form configurations
• Restrict access to the POST /custom-form/data/import endpoint
• Monitor for suspicious data imports
• Implement additional authorization checks for custom form data imports
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the corpus does not establish versions beyond 1.9.3, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.