CVE-2026-63647 in CordysCRM
Summary
by MITRE • 09/18/2026
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The disclosed vulnerability affects CordysCRM versions prior to 1.7.2, an open-source customer relationship management system that supports private deployment and utilizes server-sent events for real-time communication features such as workflow notifications, approval requests, mentions, and alerts. The core technical flaw resides in the SseController component, which exposes three specific endpoints: /sse/subscribe, /sse/broadcast, and /sse/close. These endpoints are inadvertently permitted through public access filters due to a misconfiguration within the ShiroFilter.addPublicPathFilters mechanism. This configuration error allows unauthenticated users to interact with these server-sent event channels without providing valid credentials or session tokens.
The severity of this vulnerability is compounded by how identity management is handled within the SSE endpoints. Instead of deriving user identity from an authenticated principal established during a secure login process, the system trusts caller-controlled userId parameters provided directly in requests. This design flaw enables several distinct attack vectors for unauthenticated actors. By utilizing the /sse/subscribe endpoint, an attacker can subscribe to another specific user's event stream by supplying that user's identifier. Consequently, the attacker gains access to sensitive real-time data including workflow events, approval requests, mentions, and alerts intended exclusively for the targeted individual. This represents a critical breach of confidentiality as it allows unauthorized surveillance of private business operations and personal communications within the CRM system.
Beyond information disclosure, the vulnerability also permits active manipulation of user sessions through the /sse/broadcast endpoint. An unauthenticated caller can inject SYSTEM_HEARTBEAT messages into another user's stream. While described as heartbeat messages, such injection capabilities demonstrate a lack of integrity controls over server-sent event payloads, potentially allowing for denial-of-service conditions or confusion within client-side applications that process these events. Furthermore, the /sse/close endpoint allows an attacker to forcibly terminate another user's SSE channel by targeting their specific session identifier. This action disrupts real-time notifications and updates for the victim, effectively causing a localized denial of service that degrades the reliability and availability of critical business communication features within the CRM platform.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as the system fails to verify user identity before granting access to sensitive resources. It also relates to CWE-601 URL Redirection to Untrusted Site (Open Redirect) in terms of trust boundaries and CWE-359 Exposure of Private Personal Information to an Unauthorized Actor due to the leakage of workflow data. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1530 Data from Cloud Storage Object or potentially T1499 Endpoint Denial of Service if the broadcast injection is used maliciously to disrupt operations. The root cause lies in the architectural decision to rely on client-supplied identifiers rather than server-side authenticated sessions for SSE channel management.
The recommended mitigation is straightforward and has already been implemented by the vendor. Administrators must upgrade CordysCRM to version 1.7.2 or later, where these endpoints are properly secured behind authentication checks. Until an upgrade can be performed in environments with immediate exposure risk, network-level controls such as web application firewalls should be configured to block direct access to /sse/subscribe, /sse/broadcast, and /sse/close paths from untrusted sources. Additionally, reviewing ShiroFilter configurations to ensure that public path filters do not inadvertently expose sensitive real-time communication endpoints is essential for maintaining the integrity of authentication boundaries in similar architectures.