Cordys CRM: Authorization bypass in contact lookup allows reading other users' contacts

Summary

Cordys CRM before version 1.9.6 contains an authorization bypass in the contact read function. An authenticated user with ordinary contact or customer read permission can request contacts of other users by ID and obtain names, phone numbers, owners, departments, linked customers and custom fields. No organization, owner or data-scope check is applied.

Affected

• Cordys CRM from 0 to before 1.9.6 (CVE record); VulDB reports up to 1.9.5

Fixed in

• Upgrade to Cordys CRM 1.9.6 or later

Workaround

• Unknown. No vendor workaround found.
• Interim measure: limit contact and customer read permissions to required accounts, and restrict access to internal networks or VPN.

Exploitation

• No evidence of exploitation found; not known to be exploited and not listed in CISA KEV (as reported by aggregators; CISA KEV not checked directly).
• No public proof of concept reported by ThehackerWire; GitHub not checked directly.

Our recommendation

• Upgrade Cordys CRM to 1.9.6 or later in the next maintenance window.
• Verify that the CRM is not directly exposed to the internet.
• Review accounts with contact or customer read permissions and change default or shared credentials.
• Review access logs for requests to /account/contact/get/ with IDs outside the user's own data.
• Because the data is personal data, assess the notification duties under the Swiss FADP if misuse is found.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record references: VulnCheck advisory www.vulncheck.com
• Fix commit a48c6587 github.com
• Release v1.9.6 github.com
• Tracking issue #3891 github.com
• Vulnerable controller at v1.9.5 github.com
• Vulnerable service at v1.9.5 github.com
• Cordys CRM repository github.com
• OpenCVE CVE-2026-126496 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:14.