# CVE-2026-108703: CordysCRM missing authorization in approval submission

Source: https://junglewise.ai/threats/cve-2026-108703-cordyscrm-through-1-9-3-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108703 · Severity: medium · CVSS 5.4 · Published 2026-10-11

CordysCRM is a customer relationship management application that handles business resources like contracts, invoices, and orders. The POST /approval-resource/push endpoint lacks authorization checks, allowing any authenticated user to submit arbitrary resources for approval and modify their approval status, even if they do not own those resources. An attacker with low-privilege login credentials can manipulate approval workflows and access approval details for business-critical documents they should not have permission to touch.

Technologies: [1Panel-dev CordysCRM](https://junglewise.ai/threats/technologies/cordyscrm). Vendors: [1Panel-dev](https://junglewise.ai/threats/vendors/1panel-dev).

## Quick answers

**Is CVE-2026-108703 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108703 being exploited in the wild.

**How severe is CVE-2026-108703?** Medium severity, with a CVSS score of 5.4, published 11 October 2026.

**Which products and versions are affected?** 1Panel-dev CordysCRM through 1.9.3.

**Is there a fix for CVE-2026-108703?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108703 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108703?** Check whether you run 1Panel-dev CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check in the POST /approval-resource/push endpoint of ApprovalResourceController.java. An authenticated user can supply arbitrary resourceId values for contracts, invoices, quotations, or orders without the backend verifying ownership or permission. The ApprovalResourceService.push() method performs no checkViewPermission or data-scope validation before updating approval status by resource primary key, allowing privilege escalation through request forgery.

## Affected products

- 1Panel-dev CordysCRM through 1.9.3

## Timeline

- 2026-10-11: disclosed

## References

- [https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/approval/controller/ApprovalResourceController.java](https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/approval/controller/ApprovalResourceController.java)
- [https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_approval_resource_push.py](https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/CordysCRM/poc_approval_resource_push.py)

## Related threats

- [1Panel-dev CordysCRM authorization bypass in CustomerContactController](https://junglewise.ai/threats/cve-2026-126496-1panel-dev-cordyscrm-before-1-9-6-contains-an-authorization)
- [CordysCRM authorization bypass in follow-up record endpoints](https://junglewise.ai/threats/cve-2026-108704-cordyscrm-through-1-9-3-contains-an-authorization-bypass)
- [1Panel-dev CordysCRM SSRF in webhook test endpoint](https://junglewise.ai/threats/cve-2026-108702-1panel-dev-cordyscrm-through-1-9-3-lacks-a-process-setting)
- [1Panel-dev CordysCRM authorization bypass in contract sorting](https://junglewise.ai/threats/cve-2026-108701-1panel-dev-cordyscrm-before-1-9-2-contains-a-missing)
- [1Panel-dev CordysCRM authorization bypass in field listing](https://junglewise.ai/threats/cve-2026-108700-1panel-dev-cordyscrm-before-1-9-2-contains-a-missing)