CVE-2026-63646

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.7.2

Description An authentication bypass exists in the getMcpField() function of the McpController because the ShiroFilter.addPublicPathFilters method marks the /mcp/** path as anonymous and the controller lacks a permission annotation. An unauthenticated user can access the 'GET /mcp/form/config/{formKey}' endpoint to retrieve sensitive information about CRM modules, including field names, types, required flags, default values, options, validation rules, and binding sources. This exposure allows an attacker to reconstruct the application data model to facilitate more targeted attacks against other inputs.

Recommendations Update to version 1.7.2.