CordysCRM versions up to 1.9.3 contain an authorization bypass flaw that permits authenticated users with low privileges to supply their own user ID in the owner field when invoking follow/record/add endpoints. By doing so, the attacker can create or update follow‑up records, overwriting the follow_time and follower fields for any existing customer, clue, or opportunity. The flaw does not enable code execution but allows an attacker to alter business data, compromising data integrity and potentially undermining trust in recorded customer interactions.

Installations of CordysCRM built by 1Panel-dev with a version at or below 1.9.3 are affected. The vulnerability resides in the backend modules that handle follow records as illustrated by the referenced source code and proof‑of‑concept scripts. Systems running earlier releases of CordysCRM should inspect their code for equivalent ownership checks and verify if a related patch has been released.

The CVSS score of 5.3 classifies this issue as medium severity. EPSS information is unavailable, so the probability of exploitation cannot be quantified. The flaw is not listed in the CISA KEV catalog, indicating no known widespread exploitation. A successful attack requires an authenticated session and knowledge of the target customer, clue, or opportunity identifiers; the payload is delivered via REST API calls to internal endpoints, so exposure of these endpoints to low‑privileged users or untrusted networks increases risk.