# CVE-2026-76899: CordysCRM SQL injection via sort parameter

Source: https://junglewise.ai/threats/cve-2026-76899-cordyscrm-is-an-open-source-ai-powered-customer-relationship  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-76899 · Severity: medium · CVSS 5.7 · Published 2026-09-18

CordysCRM is an open-source AI-powered customer relationship management system. An authenticated attacker with module setting update permissions can inject arbitrary SQL functions into database queries through the sort parameter, allowing them to extract sensitive database values through error-based SQL injection techniques.

Technologies: [1Panel-dev CordysCRM](https://junglewise.ai/threats/technologies/cordyscrm). Vendors: [1Panel-dev](https://junglewise.ai/threats/vendors/1panel-dev).

## Quick answers

**Is CVE-2026-76899 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76899 being exploited in the wild.

**How severe is CVE-2026-76899?** Medium severity, with a CVSS score of 5.7, published 18 September 2026.

**Which products and versions are affected?** 1Panel-dev CordysCRM 1.7.0 to 1.7.3.

**Is there a fix for CVE-2026-76899?** A patch was published on 2026-09-18: Fixed in version 1.7.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76899 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-76899?** Check whether you run 1Panel-dev CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SQL injection vulnerability in the POST /account-pool/page endpoint where the SortRequest.name parameter is inserted unsanitized into ORDER BY clauses via CommonMapper.xml. The vulnerability affects versions 1.7.0 through 1.7.3; an incomplete blacklist in SortRequest.getName() fails to block functions like extractvalue and updatexml that can be leveraged for error oracles to exfiltrate data when queries return rows. Authentication and MODULE_SETTING_UPDATE privilege are required.

## Affected products

- 1Panel-dev CordysCRM 1.7.0 to 1.7.3

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in version 1.7.4

## References

- [https://github.com/1Panel-dev/CordysCRM/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8](https://github.com/1Panel-dev/CordysCRM/commit/3e6a7003ac5c94bc1166c6065e64420be2f188a8)
- [https://github.com/1Panel-dev/CordysCRM/commit/b217166af2935c827c8d73bf55c563dd328692f5](https://github.com/1Panel-dev/CordysCRM/commit/b217166af2935c827c8d73bf55c563dd328692f5)

## Related threats

- [1Panel-dev CordysCRM authorization bypass in CustomerContactController](https://junglewise.ai/threats/cve-2026-126496-1panel-dev-cordyscrm-before-1-9-6-contains-an-authorization)
- [CordysCRM authorization bypass in follow-up record endpoints](https://junglewise.ai/threats/cve-2026-108704-cordyscrm-through-1-9-3-contains-an-authorization-bypass)
- [CordysCRM missing authorization in approval submission](https://junglewise.ai/threats/cve-2026-108703-cordyscrm-through-1-9-3-contains-a-missing-authorization)
- [1Panel-dev CordysCRM SSRF in webhook test endpoint](https://junglewise.ai/threats/cve-2026-108702-1panel-dev-cordyscrm-through-1-9-3-lacks-a-process-setting)
- [1Panel-dev CordysCRM authorization bypass in contract sorting](https://junglewise.ai/threats/cve-2026-108701-1panel-dev-cordyscrm-before-1-9-2-contains-a-missing)