← Back to the live CVE advisory feed

CVE-2026-63647: Product identification pending

Severity

9.3 (CRITICAL)

Affected versions

Before 1.7.2

Fixed version

1.7.2.

Patch status

Patched

Published

2026-09-18T20:17:20.773

Modified

2026-09-18T21:17:04.883

Why it matters

This matters because the affected product may allow code execution. Prioritize systems that are internet-facing or have privileged access to other infrastructure.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.

View the official NVD record for CVE-2026-63647

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.