CVE-2026-126496 · Package
NO FIX YET · SEE WHAT TO DO
CordysCRM before 1.9.6 has an authorization bypass in the contact lookup endpoint, so any logged-in user with contact read permission can fetch another user's contact by ID. The exposed data includes names, phone numbers, owners, departments, linked customers and custom fields.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any CordysCRM deployment before 1.9.6 where a user holds ordinary contact or customer read permission can read contacts belonging to other users, because the contact get endpoint applies no organization, owner or data-scope check. Teams that run only admins or do not use the contact module are less exposed, but the sources do not say what default permissions apply.
Not affected if no-contact-read-users, version-1.9.6-or-later
Who cares cordyscrm, crm, self-hosted
1.9.6 are in the affected range.1.9.6 or later (the sources state the fix is in 1.9.6).1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read permission can request GET /account/contact/get/{id} with another contact's ID to obtain names, phone numbers, owners, departments, linked customers and custom fields.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.