# CVE-2026-108705: CordysCRM missing authorization in custom form data import

Source: https://junglewise.ai/threats/cve-2026-108705-cordyscrm-through-1-9-3-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108705 · Severity: medium · CVSS 4.3 · Published 2026-10-11

CordysCRM is a customer relationship management system that manages business data and customer interactions. The application contains a flaw in its custom form data import feature that allows any authenticated user to upload data into forms they should not have access to, potentially creating or overwriting sensitive customer records. An attacker with valid login credentials could manipulate data across forms they don't own without requiring administrative approval.

Technologies: [1Panel CordysCRM](https://junglewise.ai/threats/technologies/1panel-cordyscrm). Vendors: [1Panel](https://junglewise.ai/threats/vendors/1panel).

## Quick answers

**Is CVE-2026-108705 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108705 being exploited in the wild.

**How severe is CVE-2026-108705?** Medium severity, with a CVSS score of 4.3, published 11 October 2026.

**Which products and versions are affected?** 1Panel CordysCRM through 1.9.3.

**Is there a fix for CVE-2026-108705?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108705 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108705?** Check whether you run 1Panel CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check in the POST /custom-form/data/import endpoint that fails to validate whether the authenticated user has permission to access a specific custom form before allowing bulk import operations. Authenticated attackers can specify any customFormId and upload Excel files with ADD or UPDATE operations to create new records or modify existing ones in forms they cannot manage. No network or user-interaction preconditions beyond valid authentication are required.

## Affected products

- 1Panel CordysCRM through 1.9.3

## Timeline

- 2026-10-11: disclosed

## References

- [https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/form/controller/CustomFormDataController.java](https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/form/controller/CustomFormDataController.java)
- [https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/form/service/CustomFormDataService.java](https://github.com/1Panel-dev/CordysCRM/blob/0d7ae06fe94f4ce33ec7f65b9d82a07ae05c2d94/backend/crm/src/main/java/cn/cordys/crm/form/service/CustomFormDataService.java)

## Related threats

- [CordysCRM unauthenticated file download in attachment preview](https://junglewise.ai/threats/cve-2026-76902-cordyscrm-is-an-open-source-ai-powered-customer-relationship)
- [CordysCRM SSRF in approval workflow configuration](https://junglewise.ai/threats/cve-2026-76900-cordyscrm-is-an-open-source-ai-powered-customer-relationship)