The reported vulnerability is a missing authorization in CordysCRM's ContractController sortModule endpoint. The POST /contract/sort route does not enforce any permission checks. Authenticated users lacking contract‑update rights can craft dragNodeId, stage, and field parameters to reorder and alter the details of any contract, including those belonging to different organization units. The flaw directly enables unauthorized modification of contract data.

CordysCRM supplied by 1Panel‑dev, versions earlier than 1.9.2 are vulnerable.

The CVSS score of 5.3 classifies this finding as medium severity. Because the EPSS score is not available and the issue is absent from the CISA KEV list, the likelihood of public exploitation appears low, yet the impact to data integrity is non‑trivial. Exploitation requires a valid authenticated session; a malicious actor can send the exploit payload to the /contract/sort endpoint after login. They can thereby re‑order, overwrite, or delete contract records that they should not have access to. The attack path is straightforward—there is no network boundary or privileged code execution needed—so an internal attacker or one who has stolen credentials can carry out the abuse.