CVE-2026-126496

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126496
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126496.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126496
Published
2026-11-11T00:58:49Z
Modified
2026-11-14T07:04:29Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id}
Details

1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding ordinary contact or customer read permission can request GET /account/contact/get/{id} with another contact's ID to obtain names, phone numbers, owners, departments, linked customers and custom fields.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126496.json"
}
References

Affected packages

Git / github.com/1panel-dev/cordyscrm

Affected ranges

Type
GIT
Repo
https://github.com/1panel-dev/cordyscrm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
16ce39f7e90fbd002d32b1231e46d6988dadaa65
Fixed
a48c6587216810bfad20b398585a51c41842184e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.9.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "a48c6587216810bfad20b398585a51c41842184e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.9.6",
            "range": [
                {
                    "fixed": "16ce39f7e90fbd002d32b1231e46d6988dadaa65"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v1.*
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126496.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "251641967153751362667856843458808577632",
                "81093659890492000023276416182162219093",
                "96726375640312230130686725950163616028",
                "134844392660073571881763223214151216513"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126496-0d067da2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/opportunity/service/OpportunityQuotationService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "1988650163891522890891834381631694613",
            "length": 3614
        },
        "id": "CVE-2026-126496-25bcec62",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/a48c6587216810bfad20b398585a51c41842184e",
        "target": {
            "file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/CustomerContactPermissionTest.java",
            "function": "preparePermissionChain"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "232654582804344969145917901768193053560",
            "length": 300
        },
        "id": "CVE-2026-126496-27ad86f3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/contract/service/ContractPaymentRecordService.java",
            "function": "getSimple"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "247236044334337193265719535571929849807",
            "length": 356
        },
        "id": "CVE-2026-126496-2a9446a4",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/form/service/CustomFormDataService.java",
            "function": "getSimple"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "88686445800197284989110970485503474729",
            "length": 346
        },
        "id": "CVE-2026-126496-3c72183f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/contract/service/ContractService.java",
            "function": "getSimple"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "210310707666961230460415490574196567920",
                "77349849232479959779531731543729359846",
                "233005197276166258434331532175399753825",
                "230265391772726440653768974830730626205"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126496-47b06854",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/contract/service/ContractPaymentRecordService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "70138283245774725149859546355387370200",
                "123153664050407793236748356311710146141",
                "58771914308736905329353218390603281283",
                "268750612112982348296099566100294082711",
                "224427301372202855634717201326618068278",
                "144639285788025645360405840597052530708",
                "202087643006492594861373314430739793701",
                "83004295376823989539798757850971324365",
                "58182659674530219065299141529266604758",
                "21079477114463386924968250601666972539",
                "268340239621565376428328791642153735440",
                "256867290323077990154344125578502540089",
                "233168761257168459413357382047398624490",
                "138712624635870077386165490755266483682",
                "284116821490894209681899120115630402820",
                "195774978733417160301889543720612487261",
                "90870408403547185666108185413412394323",
                "88054107087261920899287672502662050786",
                "195276190576071363609448687087639856373"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126496-4d28a8aa",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/a48c6587216810bfad20b398585a51c41842184e",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/customer/service/CustomerContactService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "253434064668967584635859161213040565063",
            "length": 370
        },
        "id": "CVE-2026-126496-67d56382",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/opportunity/service/OpportunityQuotationService.java",
            "function": "getSimple"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "126109685429743905154586559613488664461",
                "150687066177410868787888585706333732248",
                "330792689107887368721974242587076620687",
                "67426409265596642088055291199592227998"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126496-7b1d487c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/contract/service/ContractService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "235669124551360499889602659561641774369",
                "311911391158592046130882593931603228239",
                "283421529936700144144244928538219082254",
                "308516437272704417701572246833986392811"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126496-a2a5e06a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/form/service/CustomFormDataService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "110404434598548062569001506988208091531",
                "167962886056354630373178520610903712830",
                "251254956345356025244985250564198313291",
                "318787101179723633027313491092142618588",
                "272591278366550995307052136531547298643",
                "312309618355541564137491496980864442373",
                "307574441991646360334842782313285325029",
                "164078376273905861048013035909785757659",
                "180347532077233720969017044725918455427",
                "76732429576768216272793296243456080055",
                "334538951401935971037535539004527903",
                "90504692741397366651383688015239335317",
                "37867774354711552030789614648420651794",
                "298853738469663771372312142454084971923",
                "197594581382001608349571071621524362900",
                "323177947377516597077858458729621386660",
                "151661470926450784710637906854842160612",
                "169039385173972138216366131461408408931",
                "154333339320023207114535340912962981961",
                "264622743188036616056370076496817644055",
                "75573494534926540207675200113775942278",
                "33938100493596707008586848172827030781",
                "249191408796769995130946360644720415538",
                "188537869043737264039342580651159425325",
                "235941909153265609671420908017484623954",
                "295682247759969974101691485279807237793",
                "297600195168120569887048862955095658665",
                "4666260045070821400087165937325322044",
                "20235928318059453475932026381002023493",
                "212334268764409085345736557416466360320",
                "334626718128162394493781111971492229290",
                "213711894789236755812859843302897699353",
                "255997536351704446883550531691263779172",
                "177166351929699084218785665904365676854",
                "292830975881282443794174483178734264533",
                "119068217116500499191541963152869632561",
                "12648646181551484088786729345664612814",
                "190946437200465584085742060058663484456",
                "235447171437822458371433564847020396975",
                "281355487382783288059120565591455289529"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126496-b4778fff",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/a48c6587216810bfad20b398585a51c41842184e",
        "target": {
            "file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/CustomerContactPermissionTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "317776444073330961693518466572052924923",
            "length": 1437
        },
        "id": "CVE-2026-126496-cfb6e029",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/a48c6587216810bfad20b398585a51c41842184e",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/customer/service/CustomerContactService.java",
            "function": "get"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "316331985981578636661090446196931175461",
                "299886928870729606377595901475206090510",
                "18551769895340155574234846866589938736",
                "111188138405156965703373131595825642582"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-126496-dcc4fce2",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/order/service/OrderService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "75976602199296718655283419517630623745",
            "length": 340
        },
        "id": "CVE-2026-126496-e021978e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/16ce39f7e90fbd002d32b1231e46d6988dadaa65",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/order/service/OrderService.java",
            "function": "getSimple"
        }
    }
]
vanir_signatures_modified 
"2026-11-14T07:04:29Z"