The vulnerability arises from missing authorization logic in eight /field/source endpoints of the ModuleFieldController. This flaw allows authenticated users who are denied permission to a module to enumerate and retrieve leads, contacts, quotations, contracts, payment plans, payment records, orders, and invoices across the entire organization. Without proper permission checks, attackers can read sensitive business data, resulting in a confidentiality breach of all modules that are exposed through these endpoints.

Affected systems include the 1Panel‑dev CordysCRM product, specifically the 1.9.0 and 1.9.1 releases, as the fix was introduced in 1.9.2. The vulnerability is present in the DataScopeService and ModuleFieldController classes across the backend CRM component. Systems running these versions should review their deployment to confirm the presence of the flaw.

The CVSS score of 7.1 classifies the issue as High severity, and the EPSS score is currently unavailable, indicating that exploitation likelihood has not been measured. The vulnerability is not catalogued in the CISA KEV list. An attacker must first authenticate to the application, so the exploitation vector is likely internal or via compromised credentials. Once authenticated, they can simply issue requests to the affected endpoints and receive full data sets, making this a significant risk for organizations with sensitive customer information.