CVE-2026-63647

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.7.2

Description SseController exposes the anonymous '/sse/subscribe', '/sse/broadcast', and '/sse/close' endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths. These endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use '/sse/subscribe' to read another user's workflow events, approval requests, mentions, and alerts, use '/sse/broadcast' to inject SYSTEM HEARTBEAT messages into another user's stream, or use '/sse/close' to terminate another user's channel.

Recommendations Update to version 1.7.2.