CVE-2026-108705 in CordysCRM
Summary
by MITRE • 10/11/2026
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with importType ADD or UPDATE to create records in, or overwrite existing records of, custom forms they cannot manage.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified within CordysCRM versions up to 1.9.3 represents a critical failure in access control mechanisms, specifically classified under CWE-862 as Missing Authorization. This flaw resides in the POST /custom-form/data/import endpoint, which is designed to facilitate bulk data operations by accepting Excel files for importation into custom forms. The core technical deficiency lies in the server-side validation logic, which fails to verify whether the authenticated user possesses sufficient privileges to modify or create records within the specific target form identified by the customFormId parameter. Instead of enforcing role-based access controls that restrict write operations to authorized administrators or designated managers, the system relies solely on the presence of a valid authentication token. This architectural oversight allows any logged-in user, regardless of their assigned security clearance level, to interact with data structures outside their permitted scope.
From an operational perspective, this vulnerability enables low-privileged attackers to perform unauthorized data manipulation actions such as creating new records or overwriting existing ones in custom forms they do not own or manage. By crafting malicious HTTP requests that specify a target customFormId associated with sensitive business processes or restricted datasets, an attacker can inject false information, exfiltrate context by observing error messages during failed updates, or disrupt operational integrity through data corruption. The ability to use importType parameters set to ADD or UPDATE amplifies the risk, as it permits both the proliferation of unauthorized entries and the silent alteration of critical historical records without triggering standard audit alerts for privilege escalation attempts.
The impact extends beyond simple data tampering; it undermines the fundamental trust model of the CRM system by allowing lateral movement within application resources based on identifier enumeration rather than permission checks. Attackers can potentially identify valid custom form IDs through brute force or information disclosure and then apply malicious imports to compromise confidentiality, integrity, and availability of business-critical information stored in those forms. This aligns with ATT&CK technique T1078 Valid Accounts, where attackers leverage legitimate credentials to bypass perimeter defenses, combined with aspects of data manipulation techniques that disrupt organizational processes.
Mitigation strategies must prioritize the immediate implementation of strict access control checks at the endpoint level before any import logic is executed. Developers should ensure that every request to POST /custom-form/data/import includes a verification step confirming that the current user's role or permissions explicitly allow write operations on the specific customFormId provided in the payload. Additionally, implementing principle of least privilege across all API endpoints and conducting regular code reviews focused on authorization logic can prevent similar flaws. For existing deployments, applying vendor-provided patches is essential, while interim compensating controls may include restricting access to this endpoint via network-level firewalls or Web Application Firewalls that monitor for anomalous import patterns from low-privilege accounts.