CVE-2026-76901
- Source
- https://cve.org/CVERecord?id=CVE-2026-76901
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76901.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-76901
- Aliases
-
- GHSA-hxp2-5w5p-2grq
- Published
- 2026-09-18T19:55:16Z
- Modified
- 2026-09-20T14:13:56Z
- Severity
-
- 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts
- Details
-
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in PoolClueController.get and GET /pool/account/get/{id} in PoolCustomerController.get use bare pool-read permission checks without the CsPermission resourceId binding that enforces per-record data scope. An authenticated user with the ordinary CLUE_MANAGEMENT_POOL:READ or CUSTOMER_MANAGEMENT_POOL:READ permission can supply another record's id and cause unscoped primary-key getters to return leads or accounts owned by other users, departments, or organizations. Exposed data includes contact names, phone numbers, owner and department attribution, and custom field values. This issue is fixed in version 1.7.4.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-639" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76901.json" }- References
-
- https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4
- https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-hxp2-5w5p-2grq
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76901.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-76901
- https://github.com/1Panel-dev/CordysCRM/commit/34c7c3e5de2585208744926007530037a4ce4da5
- https://github.com/1Panel-dev/CordysCRM/pull/2976
Affected packages
Git / github.com/1panel-dev/cordyscrm
Affected versions
v1.*
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.7.1
v1.7.2
v1.7.3
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76901.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "236522838509542512797473307434147467390",
"length": 372
},
"id": "CVE-2026-76901-0a7d67d6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java",
"function": "createPickRule"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"13848738090332839408333930343557301546",
"184178719509864260159069695227719821349",
"283994517521815669523892263793462963162",
"305829752335125088064714332491820339759",
"299825275263027906968890305921372534535",
"333367736956555580890348606906191967687",
"192816064804338699085949980103304394363",
"116753171242454737678315893271982260046",
"17039080364180661244229057763382687729",
"329008562128013794432607145191802075291",
"86729615264053788659869882973498869987",
"245717019108317909333475656189707888276",
"39798656819947043461681115650212324555",
"2760957885934971392255428996473904455",
"10518702740964770887593880842467860522",
"137482833149205635880686061749881332332",
"113002369107675112957607868829425739576",
"84600210451915961871519035055466370234",
"141425654298382446580361134712337050167",
"317587099304494962274448724073639056664",
"52685741425362077791396071587746387364",
"131515767733917361434861851824542813765",
"17357855258562380967652937330652973212",
"293908924593339441545298983008169856128",
"39412705159515738231876697949011450496",
"158208834530883566992233279873798913241",
"315251353961361701100140771814728583114",
"44537269101344391757703725276633404409",
"215844072245526107682459172294664899772",
"87240664006760545027454582231244624580",
"241012470527213200614732478614584469609",
"47067977309394508151268366000279347527",
"60370879583003808747318228524914275666",
"170386045053747012885573121783453439964",
"281270712782463348223499999104960576058",
"221331356035127468717325759405210762822",
"54570407493306803169175248946439864943",
"157462917448050251896013588855211123216",
"76532815200504941151610657608338167552",
"204255238219496593620904105739119179468",
"19270850080153415847758134746112312696",
"231448129498923824851847213638794092238",
"56296042243158829879524590389434313932",
"309667351998425839197040069500920839426",
"63442883934726103137810794538419535306",
"339321393174637651547607778882526816164",
"16063977131393802988452143862622154434",
"222640897610571246932714688006231724068",
"243692116641837522840873453422578284168",
"198919735405642894289360801838856173246",
"130317011498114096515939060233085580274",
"102922425438077856697110949965985517124",
"306074808065968268290720543645170535466",
"377003702489782703408202229471522515",
"54501905465865186203317353750538752019",
"208602174546008605903143588817196391323",
"276396303993557808998715504360132479532",
"214819059629768248447186283271586788595",
"302651134952703570782836009503459517143",
"92574199328220254756397583593269886685",
"145230483238184949053896906695745266216",
"314383548596621947350587642915009706106",
"108296216350374315728984625178819537037",
"176892050032617767513134131762638446464",
"276435466147817065642271378728280671443",
"89971347865651449058244765449704555321",
"65716006848966205032797133049412637524",
"295923717825346675024096430237663886056",
"163275035720462297680705212768778947295",
"88446307461630185285590375210790866896",
"73023722945989110586249245161995121603",
"146813322131636070929595488595923038589",
"245082855496443073197338171910586553235",
"304048357620216225831834139114573265529"
],
"threshold": 0.9
},
"id": "CVE-2026-76901-0d5ae180",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "247805433015393001312534680642650420690",
"length": 166
},
"id": "CVE-2026-76901-1574f5e1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "pick"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "201769393570587072556648191545341872320",
"length": 3087
},
"id": "CVE-2026-76901-32d7bb4b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/service/PoolCustomerService.java",
"function": "getPoolOptions"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "213401919767839790413013759793090088658",
"length": 250
},
"id": "CVE-2026-76901-35a19ba2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java",
"function": "batchDeleteSuccess"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292798410393552237876853615354545856846",
"length": 438
},
"id": "CVE-2026-76901-399481e5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java",
"function": "batchAssignFailWithNotExit"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "24310659596535141221183362092753599857",
"length": 220
},
"id": "CVE-2026-76901-451e282c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java",
"function": "batchDeleteSuccess"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "82673762171859174990885005906623628156",
"length": 244
},
"id": "CVE-2026-76901-48da005b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java",
"function": "assignSuccess"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"310319214403462864406749850499542674715",
"95637553897885096828379260897994602973",
"267074912434199031348264420409627044293",
"260050111207340050422071997688215493581",
"96266704733093137066130245977102937043",
"99914139808872567089438281240452311508",
"41476120754097678455109568411126265524",
"157562351324187170033125242562782052879",
"12971301483517125761071548806838753078",
"64232746123780566998374897832018813017",
"104708731160307383684950080080706055987",
"312383667942467745492517200340118177623",
"228977824741285247603413882865477387496",
"229594277570311846930208410874425730837",
"152005122999086181260990175812804684910",
"105290572085374463982938810529351899117",
"10518702740964770887593880842467860522",
"104245406734840665445416628854882555599",
"117781528718025299165320099187437753954",
"146053545682001205372979610686660205272",
"137482833149205635880686061749881332332",
"329201903256939269488004184464494234714",
"90122351700689423485330620829409914758",
"83635246239877309928401975799079701714",
"284619059098474593609296587428877792728",
"248306591474707720787916247247712884269",
"47545173545249753924970241199765951186",
"20371734525570831127473619730191028968",
"51299474482839667533462365124351537337",
"39412705159515738231876697949011450496",
"75228987512411216042788556723460592494",
"6481051347609266771027473524130859505",
"197944791770645229621946938240377287382",
"251470274422079075406062705306096167797",
"19272488055617640109430435716109415450",
"69252675271759314519457474783125244028",
"209231541033874781158292498993966073556",
"37416120438867906391298466088680516879",
"321136274777042370466215142879159137132",
"325411649078557400814723224820107785692",
"18776921389222042804045996632718983893",
"157626246431794857029098948302135491386",
"2061970345773244139227374883617949577",
"39136577993354377951326595124330975551",
"250505881427391080815641458451144405986",
"223539779864289380818935949008399028882",
"252100050875381517510174311050943420251",
"189923543894664027861620473413704411448",
"201486247531269325409985300258846960744",
"234996932979952311632396292685622074148",
"9859614747013614200130251490051179239",
"117763744737981574770386981152145265784",
"23176773630060709996124193950102310598",
"91618503622799903125416604901198233843",
"102922425438077856697110949965985517124",
"100294955256468385778327744604780020025",
"274814294705085131311019929747583972607",
"20529648997495345227064036491239329835",
"326784190705139122950965573474069815848",
"202633868375647090997451203747438113431",
"324278692285603154121100159687442511767",
"160118355289219647251098102703547586013",
"169541672241333371196079042891664238065",
"54501905465865186203317353750538752019",
"111506369885196766792621397982399357148",
"42451299597241923298205575002536028702",
"313481904380390654921088100786346043157",
"249562592420123209485013640206785094958",
"233520649699963665071893965871143493317",
"257387244810254875063744853689600393237",
"94007296836757556641020032332179520265",
"224307999516801385205241529897487495411",
"212450174585299981822182199569658394466",
"43306538511169907904875774969951244561",
"339387811233771828687001002036851217530",
"245082855496443073197338171910586553235",
"304048357620216225831834139114573265529"
],
"threshold": 0.9
},
"id": "CVE-2026-76901-4f568860",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "78338167672696802600228120855675761263",
"length": 88
},
"id": "CVE-2026-76901-52e9365e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "delete"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "39533916842503152756071232438386619179",
"length": 732
},
"id": "CVE-2026-76901-55987fc8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java",
"function": "pickFailWithOverCapacity"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "61639875815489191972206543488321874720",
"length": 92
},
"id": "CVE-2026-76901-60d6a620",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "delete"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "108646649797873003698062458144155567954",
"length": 299
},
"id": "CVE-2026-76901-6408684e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java",
"function": "prepareTestData"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "237224285205321804862883412507948359168",
"length": 594
},
"id": "CVE-2026-76901-659a99e2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java",
"function": "batchPickFailWithOverDailyOrPreOwnerLimit"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"128841636036280899014933205245552789431",
"61899691071485560621731698649138955741",
"49494271850354406966387354846162307569",
"127232147084434518550109744341192913113",
"101549279956925005570977346808601184697",
"294617784401948048236346219038269067237",
"113287804611347332040317867436587960038",
"164577380041815927719460294998589965121",
"129080229857183031115029840399186383257",
"214937700170430058392133117658036950341",
"181896565417686621848741689650768124038"
],
"threshold": 0.9
},
"id": "CVE-2026-76901-685ed874",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/service/PoolCustomerService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "257096696335737193703032516611092256910",
"length": 170
},
"id": "CVE-2026-76901-68866179",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "batchUpdate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "249814189414866014824652590306184665645",
"length": 95
},
"id": "CVE-2026-76901-6c3ffd28",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "get"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "236522838509542512797473307434147467390",
"length": 372
},
"id": "CVE-2026-76901-6d5a543a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java",
"function": "createPickRule"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "232230020303360344895445649077754824655",
"length": 185
},
"id": "CVE-2026-76901-6db15114",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "batchDelete"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "77717599826620231237421741924638747633",
"length": 578
},
"id": "CVE-2026-76901-6f531f6d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java",
"function": "batchPickFailWithOverDailyOrPreOwnerLimit"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "95845157196813559956692231909653454709",
"length": 748
},
"id": "CVE-2026-76901-8260eddc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java",
"function": "pickFailWithOverCapacity"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "292156832230025715906593991440845407508",
"length": 457
},
"id": "CVE-2026-76901-84e4cb79",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java",
"function": "createCustomer"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "250998711305133699533735843319888851828",
"length": 3109
},
"id": "CVE-2026-76901-867e534f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/service/PoolClueService.java",
"function": "getPoolOptions"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "241241777508211321460018221105563976296",
"length": 631
},
"id": "CVE-2026-76901-870d3515",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "exportAll"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "173739337492906917709600892269299001258",
"length": 184
},
"id": "CVE-2026-76901-886697d9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "chart"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "257096696335737193703032516611092256910",
"length": 170
},
"id": "CVE-2026-76901-8c5d3606",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "pick"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "333113137469949884488840325916853491613",
"length": 193
},
"id": "CVE-2026-76901-8de19d9c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "batchAssign"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "151201358742953828769874840884341231255",
"length": 208
},
"id": "CVE-2026-76901-92765905",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "assign"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "301598515387173984769046313638097193122",
"length": 591
},
"id": "CVE-2026-76901-98252196",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "exportSelect"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "30226335026900900084872757582045615435",
"length": 91
},
"id": "CVE-2026-76901-9d0dbb73",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "get"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "330305505393254738171354294692052757700",
"length": 1003
},
"id": "CVE-2026-76901-9d70f49d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java",
"function": "testExport"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "65650321240422455698074021067301331702",
"length": 601
},
"id": "CVE-2026-76901-a095fce7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "customerPoolExportSelect"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "220308264193050173466155464049909209889",
"length": 189
},
"id": "CVE-2026-76901-a0d3af45",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "batchAssign"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "164381558575411272706038815511580762037",
"length": 394
},
"id": "CVE-2026-76901-a11e466f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "list"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "152888698106396682533420301678478915534",
"length": 390
},
"id": "CVE-2026-76901-aef0ee90",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "list"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "107652263606614537455451760224215265079",
"length": 291
},
"id": "CVE-2026-76901-b2d2a23b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java",
"function": "prepareTestData"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "247805433015393001312534680642650420690",
"length": 166
},
"id": "CVE-2026-76901-b346f4d7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "batchPick"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"32786354791444728017991213588405127795",
"206673824334608522410734558077394242332",
"106091610675381695145943272218168862870",
"16693993996899684498761765220888936215",
"80450655342367294562617436887854927480",
"320411219716299147058245227345521898435",
"250985657001293160026702855051190527637",
"290794907096190000592760818098315325075",
"115435765898910987556665109578992177304",
"301426687344180108370375591032681682415",
"141096676927476041902970452905569389096",
"336126493098066323296424566685050069129",
"148844330985340806285722047258013956237",
"75996088182925528737185700050472935187",
"264455724160572284318031039280257050964",
"36446353500723282827407269325692827893",
"335236918728852024239147965072442890061",
"241468949107859605656570329122377179239",
"251495978328260209258213201310304658118",
"324674109938545373725577888409200006119",
"216665213931458566058982602784983359154",
"338078857976118404230951179698743613014",
"261827260659141568912443970729861105541",
"229650141097076896823228226997687590325",
"155050981013176673884636307501287446028",
"163420435706616511202974456026959720459",
"228183128490129219741109172679762351145",
"258764874965626373375170976958677864471",
"296866045889016134199367109792054663743",
"196923062613050714302325752460546599044",
"30835500620064595122108524640461710703",
"62405846086223983519028729407407396855",
"71805443048839235538861985391011254991",
"93281066134114854539592568614610398212",
"146534965232476879881329793437499051938",
"258123936908954989352948288450760994453",
"256773444426362580360321953611245739183",
"99223550122584296484125751518864312841",
"186189780870371428248343841115635680537",
"84906937867924632731452220191812611644",
"176256069388432149352403785468542180259",
"199042854355076065576282486364766484514",
"107263652564259908127935890659463143694",
"29430404802151930228871869949807273105",
"106490554709210538454275720555696875153",
"40273684230189121618910953523564073701",
"140978398266052533701672041054632502685",
"165465102291688347544632018746590035028"
],
"threshold": 0.9
},
"id": "CVE-2026-76901-b3dd5bbe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "222537375913978947286416360117028382019",
"length": 165
},
"id": "CVE-2026-76901-b4550bdd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "batchDelete"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "238304101259911992327117988839120819315",
"length": 355
},
"id": "CVE-2026-76901-bcab4fbd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/customer/controller/PoolCustomerControllerTests.java",
"function": "page"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"297035554684689859976900268137718555754",
"170303434073081179366561086831023795378",
"45846805413225389400126786608722788331",
"137435120986061611741588412491777321525",
"269534725956125332894559569595136165384",
"117988473800182647043574568235015816399"
],
"threshold": 0.9
},
"id": "CVE-2026-76901-c81882a1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/83bd0bf7422c0391af6c2f798f62c624a056bf6b",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/follow/service/BaseFollowUpService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "320144658412324829475839133206321393830",
"length": 1596
},
"id": "CVE-2026-76901-c823bc9d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/83bd0bf7422c0391af6c2f798f62c624a056bf6b",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/follow/service/BaseFollowUpService.java",
"function": "checkRecordPermission"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "100165439640477155414682722566882595406",
"length": 186
},
"id": "CVE-2026-76901-cc78ef11",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "chart"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "168941621957135736311013978142897276179",
"length": 645
},
"id": "CVE-2026-76901-cd43e9eb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "customerPoolExportAll"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"116128689766381682241757482072104525033",
"294012826135894056623145314994974751891",
"153860345141689137011270779073715407852",
"245013220503742386802959462701391837607",
"218965486142645533972296897685261362218",
"327762393964692459596560875407686761425",
"117342932305020592366423814260640948753",
"145411034071276379492241061688570720635",
"264868012190150989171033119738548382493",
"258235575424311965824843514918504888691",
"69337779408551572087213781698988419161"
],
"threshold": 0.9
},
"id": "CVE-2026-76901-d41187dc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/service/PoolClueService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "247805433015393001312534680642650420690",
"length": 166
},
"id": "CVE-2026-76901-e28cd25b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "batchUpdate"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"211040325749955499446412246474343960282",
"193551733463637534220049461905526164464",
"318304362229214252634744744529004216645",
"325541540388841619979814671570097478822",
"25267317502738967276638889033190928552",
"274671039111205503445703922293243040502",
"263925186288525051750093685445042437843",
"176828356382887648172777905637260129198",
"320667485605774270738561828482537235822",
"324222640628085985155442592709631565786",
"126125197428154560588457221726476360709",
"257369889250059617815556908327542776331",
"34073689478033392939851480836990648022",
"207976615787629531533693469471467301493",
"313558095793495886088044788648105725793",
"266907704991888332450938561331898438584",
"76658942006510928857371679549926793458",
"134406612618118363691211172651626788193",
"129352806636591160604979806272614625577",
"155422498188230994781454612337462539731",
"333626186390116051136828553863515644111",
"208660263321775192624314119409316766869",
"209890380452387961218077919335956298634",
"148159877768910468553448606787577858135",
"193592930607130544914920017582379454921",
"218165278750556815299362895878433294247",
"192025476820901182290847352058883179398",
"338116966867617032830245698571461758174",
"26427709454439300460511470084332364747",
"270733555290217727372326047501003702736",
"323729754830518450343497126921629934454",
"266389197576860063793595161495226112052",
"330421221941629508105916297494502845993",
"164728109023496805976069530989644139696",
"83313957029158867649852040177363681194",
"165963914210716769071041120381252340239",
"61575831860814798302926618591412235005",
"162596175034470568116199977978170958924",
"178975703412546947475912198730191888567",
"268699248729333139397449590870640052755",
"155445561592265287182554480790339706715",
"180410479710712553591248440909465540840",
"37146301393491445769222166959172202494",
"262630556126348162179374574910035069727",
"88744220622910015846046076811108090203",
"271372951424938247668358581396061775587",
"149041826033492345046822389130897775274",
"15049766729993416937370815809848320"
],
"threshold": 0.9
},
"id": "CVE-2026-76901-e5928c0e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "309855224336350406137020008833299111079",
"length": 531
},
"id": "CVE-2026-76901-e7205994",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java",
"function": "createClue"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "257096696335737193703032516611092256910",
"length": 170
},
"id": "CVE-2026-76901-e9645efa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/customer/controller/PoolCustomerController.java",
"function": "batchPick"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "102782835202913461847355570152967075061",
"length": 351
},
"id": "CVE-2026-76901-ec41638e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java",
"function": "page"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "195326069403074871668355998989428208906",
"length": 240
},
"id": "CVE-2026-76901-f3239a63",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/test/java/cn/cordys/crm/clue/controller/PoolClueControllerTests.java",
"function": "assignSuccess"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "162046586244841311711558285291701253639",
"length": 204
},
"id": "CVE-2026-76901-f6e00aa6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/1panel-dev/cordyscrm/commit/34c7c3e5de2585208744926007530037a4ce4da5",
"target": {
"file": "backend/crm/src/main/java/cn/cordys/crm/clue/controller/PoolClueController.java",
"function": "assign"
}
}
]
vanir_signatures_modified
"2026-09-20T14:13:56Z"