CVE-2026-76901

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.7.4

Description An authenticated user with CLUE MANAGEMENT POOL:READ or CUSTOMER MANAGEMENT POOL:READ permissions can access leads or accounts belonging to other users, departments, or organizations. This occurs because the system performs basic permission checks without enforcing per-record data scope via CsPermission resourceId binding. An attacker can provide a different record's id to the endpoints '/pool/lead/get/{id}' in the PoolClueController.get function or '/pool/account/get/{id}' in the PoolCustomerController.get function to retrieve sensitive information, including contact names, phone numbers, owner and department attribution, and custom field values.

Recommendations Update to version 1.7.4. Avoid using the id parameter in the '/pool/lead/get/{id}' and '/pool/account/get/{id}' endpoints to request records not owned by the current user until the update is applied.