Is CVE-2026-108692 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108692 being exploited in the wild.

How severe is CVE-2026-108692?

Medium severity, with a CVSS score of 6.5, published 11 October 2026.

Which products and versions are affected?

1Panel-dev CordysCRM 1.9.0 to 1.9.1.

Is there a fix for CVE-2026-108692?

Yes: fixed in CordysCRM 1.9.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108692 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-108692?

Check whether you run 1Panel-dev CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108692: 1Panel CordysCRM missing authorization in ModuleFieldController

CVE-2026-108692 · Severity: medium · CVSS 6.5 · Published 2026-10-11

1Panel CordysCRM is a customer relationship management system for organizing sales data. The application fails to properly check permissions on eight data endpoints, allowing authenticated users to view sensitive customer information (leads, contacts, quotations, contracts, payments, and orders) belonging to other users or departments, even if their account should not have access to these records.

Technologies: 1Panel-dev CordysCRM. Vendors: 1Panel-dev.

Quick answers

Is CVE-2026-108692 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108692 being exploited in the wild.
How severe is CVE-2026-108692?: Medium severity, with a CVSS score of 6.5, published 11 October 2026.
Which products and versions are affected?: 1Panel-dev CordysCRM 1.9.0 to 1.9.1.
Is there a fix for CVE-2026-108692?: Yes: fixed in CordysCRM 1.9.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108692 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-108692?: Check whether you run 1Panel-dev CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: CordysCRM 1.9.2

Technical details

The ModuleFieldController's /field/source endpoints lack authorization checks before returning organization-wide data records. An authenticated user without module permission can exploit this missing authorization to enumerate and access sensitive business data across the organization. The vulnerability affects eight endpoints serving leads, contacts, quotations, contracts, payment plans, payment records, orders, and invoices.

Affected products

1Panel-dev CordysCRM 1.9.0 to 1.9.1

Timeline

2026-10-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.