CVE-2026-63647

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.

• CWE-306
• CWE-639

• https://github.com/1Panel-dev/CordysCRM/commit/6cb81deb53434ae7792673c50312ff91685d7f9d
• https://github.com/1Panel-dev/CordysCRM/pull/2719
• https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.2
• https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4
• https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-9qg8-cm35-xqp4

Published

Sep 18, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63640MagicMirror² is an open source modular smart mirror platform…4.3
• CVE-2026-63641MagicMirror² is an open source modular smart mirror platform…2.3
• CVE-2026-63642MagicMirror² is an open source modular smart mirror platform…6.3
• CVE-2026-63643MagicMirror² is an open source modular smart mirror platform…6.3
• CVE-2026-63645OpenObserve is a cloud-native observability platform. Prior …7.5
• CVE-2026-63646CordysCRM is an open source AI-powered customer relationship…6.9
• CVE-2026-63649The Windows interactive service in OpenVPN 2.4.0 through 2.6…4.1
• CVE-2026-6365Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2026-63650OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote…2
• CVE-2026-63652FreeRDP is a free implementation of the Remote Desktop Proto…6.5
• CVE-2026-63654Frappe is a full-stack web application framework. In version…6.9
• CVE-2026-6366Improperly Controlled Modification of Dynamically-Determined…6.6