CVE-2026-63646 in CordysCRM
Summary
by MITRE • 09/18/2026
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/form/config/{formKey} calls McpController.getMcpField without authentication because ShiroFilter.addPublicPathFilters marks /mcp/** as anonymous and the controller has no permission annotation. An unauthenticated caller can obtain field names, types, required flags, default values, options, validation rules, and binding sources for CRM modules, allowing reconstruction of the application data model and more targeted attacks against other inputs. This issue is fixed in version 1.7.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in CordysCRM prior to version 1.7.2 represents a critical authentication bypass within its Model-Controller-Presenter architecture, specifically affecting the endpoint GET /mcp/form/config/{formKey}. This flaw stems from an incorrect configuration of the Apache Shiro security filter chain, where the path pattern /mcp/** was explicitly designated as anonymous or public access. Consequently, any request directed to this URL structure bypasses authentication checks entirely. The McpController.getMcpField method, which handles these requests, lacks additional role-based or permission-based annotations that could have enforced authorization controls even if the filter chain had been misconfigured. This combination of a broad public path definition and missing granular access control logic creates an open door for unauthenticated actors to interact with sensitive internal APIs.
The operational impact of this vulnerability is significant due to the nature of the data exposed by the form configuration endpoint. An attacker can retrieve comprehensive metadata regarding CRM modules, including field names, data types, required status flags, default values, available options, validation rules, and binding sources. This information effectively allows for the reconstruction of the application's internal data model without needing valid credentials. By understanding how fields are structured, validated, and bound to backend entities, an attacker gains deep insight into the system's logic and database schema. This reconnaissance phase is often a precursor to more sophisticated attacks, such as targeted SQL injection or cross-site scripting attempts against specific input vectors that were previously unknown or poorly understood by external adversaries.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to verify identity before granting access to protected resources. It also relates closely to CWE-601 URL Redirection Through Unvalidated Redirect and CWE-359 Exposure of Private Personal Information, given that the exposed metadata can reveal sensitive business logic and potentially personal data structures inherent in a CRM system. In terms of offensive security frameworks like MITRE ATT&CK, this flaw facilitates the Reconnaissance phase (T1592) by allowing attackers to gather victim identity information and application configuration details. It also supports subsequent exploitation phases such as Input Validation Discovery (T1608), where understanding validation rules helps in crafting payloads that bypass client-side or server-side checks more effectively.
To mitigate this risk, organizations running versions of CordysCRM prior to 1.7.2 must upgrade immediately to the patched version which corrects the Shiro filter configuration and enforces proper authentication on all API endpoints. For environments where an immediate upgrade is not feasible, a temporary mitigation involves configuring the web server or reverse proxy to block direct access to the /mcp/** path from untrusted networks. Additionally, implementing strict input validation and output encoding across all exposed APIs can reduce the impact of any subsequent exploitation attempts that leverage the discovered data model information. Regular security audits of authentication filter configurations are essential to prevent similar misconfigurations in other enterprise applications relying on Apache Shiro or similar security frameworks.