CVE-2026-76899

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-76899
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76899.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-76899
Aliases
  • GHSA-x6p7-vhgp-6r3q
Published
2026-09-18T19:58:47Z
Modified
2026-09-26T08:12:03Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L CVSS Calculator
Summary
CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
Details

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULE_SETTING_UPDATE to place an arbitrary database function in SortRequest.name because CustomerPoolController.page omits Spring request validation, SortRequest.getName relies on an incomplete blacklist, and the CommonMapper.xml sort fragment inserts ${sortName} into an ORDER BY clause. Functions such as extractvalue and updatexml bypass the blacklist and can expose database values through an error oracle when the query returns at least one row. This issue is fixed in version 1.7.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1284",
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76899.json"
}
References

Affected packages

Git / github.com/1panel-dev/cordyscrm

Affected ranges

Type
GIT
Repo
https://github.com/1panel-dev/cordyscrm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3e6a7003ac5c94bc1166c6065e64420be2f188a8
Fixed
b217166af2935c827c8d73bf55c563dd328692f5
Fixed
83bd0bf7422c0391af6c2f798f62c624a056bf6b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.7.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.7.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76899.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "245193253129316440598382991734002423039",
            "length": 113
        },
        "id": "CVE-2026-76899-4131fb94",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b217166af2935c827c8d73bf55c563dd328692f5",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java",
            "function": "getName"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "215954594939956255917806477642623379595",
                "313172783840790578454716607614565092742",
                "117208727282530436666466976147679310932",
                "289388144321452097844169252101863119365",
                "297234934043107059455536974148504290579",
                "288768825630198485824502294631252481115",
                "266893733843946177112458391925280789570",
                "339330308103021372886739167954803728109",
                "125932562726305523758781769690702236107",
                "47865153585571441123811295773513132670",
                "139340833860282417045201915023441445622",
                "157958171292496496639170860107592962213"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76899-55d7a3ad",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "245193253129316440598382991734002423039",
            "length": 113
        },
        "id": "CVE-2026-76899-5c1347dc",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java",
            "function": "getName"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "36939992524026194977355764721639335368",
                "299613181574386786860473550387497134424",
                "309665613272923111831300165128868650913",
                "106045920721628309663517547447100411342"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76899-718649a3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/CustomerPoolController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "215954594939956255917806477642623379595",
                "313172783840790578454716607614565092742",
                "117208727282530436666466976147679310932",
                "289388144321452097844169252101863119365",
                "297234934043107059455536974148504290579",
                "288768825630198485824502294631252481115",
                "266893733843946177112458391925280789570",
                "339330308103021372886739167954803728109",
                "125932562726305523758781769690702236107",
                "47865153585571441123811295773513132670",
                "139340833860282417045201915023441445622",
                "157958171292496496639170860107592962213"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76899-72e0124c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b217166af2935c827c8d73bf55c563dd328692f5",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/common/dto/SortRequest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "297035554684689859976900268137718555754",
                "170303434073081179366561086831023795378",
                "45846805413225389400126786608722788331",
                "137435120986061611741588412491777321525",
                "269534725956125332894559569595136165384",
                "117988473800182647043574568235015816399"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76899-c81882a1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/83bd0bf7422c0391af6c2f798f62c624a056bf6b",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/follow/service/BaseFollowUpService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "320144658412324829475839133206321393830",
            "length": 1596
        },
        "id": "CVE-2026-76899-c823bc9d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/83bd0bf7422c0391af6c2f798f62c624a056bf6b",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/follow/service/BaseFollowUpService.java",
            "function": "checkRecordPermission"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "36939992524026194977355764721639335368",
                "299613181574386786860473550387497134424",
                "309665613272923111831300165128868650913",
                "106045920721628309663517547447100411342"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-76899-d0e34a3d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b217166af2935c827c8d73bf55c563dd328692f5",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/CustomerPoolController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "154833347256935526530723069678555613398",
            "length": 260
        },
        "id": "CVE-2026-76899-f6e7d8ac",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/CustomerPoolController.java",
            "function": "page"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "154833347256935526530723069678555613398",
            "length": 260
        },
        "id": "CVE-2026-76899-fdc6134c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/1panel-dev/cordyscrm/commit/b217166af2935c827c8d73bf55c563dd328692f5",
        "target": {
            "file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/CustomerPoolController.java",
            "function": "page"
        }
    }
]
vanir_signatures_modified 
"2026-09-26T08:12:03Z"