Executive brief
CordysCRM is an open-source AI-powered customer relationship management system. An unauthenticated attacker can access the form configuration API endpoint to extract sensitive metadata about the application's data model, including field names, types, validation rules, and default values. This information exposure allows attackers to map the application structure and prepare more targeted attacks against other parts of the system.
Technical details
The vulnerability is an authentication bypass in the GET /mcp/form/config/{formKey} endpoint of McpController. The endpoint is marked as anonymous in ShiroFilter without permission annotations, allowing unauthenticated access to retrieve detailed form metadata. An attacker with network access can enumerate form structures and data model details to inform reconnaissance and subsequent targeted exploitation.
Affected products
- 1Panel-dev CordysCRM prior to 1.7.2
Timeline
- 2026-09-18: disclosed
- 2026-06-17: patched