The vulnerability is a missing authorization check that allows any authenticated user to POST to the /field/source/business-title endpoint. The response returns a list of business titles, each containing sensitive information such as tax identification numbers, bank account numbers, opening banks, registration addresses, and phone numbers. This omission enables the disclosure of confidential corporate and financial data to any authenticated account that lacks the required permission.

CordysCRM installations released by 1Panel-dev before version 1.9.2 are impacted. These older versions expose the endpoint to all authenticated users without verifying the CONTRACT_BUSINESS_TITLE_READ permission.

The CVSS score of 7.1 indicates high severity, but the EPSS score is not available, leaving the likelihood of exploitation uncertain at this time. The flaw is categorized as CWE‑862 (Missing Authorization). An attacker must first authenticate, after which the missing permission check allows arbitrary retrieval of sensitive business information. The vulnerability is not listed in the CISA KEV catalog, and no publicly documented exploits have been reported.