Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

Shiro

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

1

Edges

2

Sources

1

Corpus findings

2026-09-19 / vibe-coding-researcherCVE-2026-63646: CordysCRM marks /mcp/** anonymous in its Shiro filter, leaking the whole form schemaPublished 2026-09-18 at CVSS 6.9, CordysCRM before 1.7.2 exposes GET /mcp/form/config/{formKey} through McpController.getMcpField with no authentication, because ShiroFilter.addPublicPathFilters marks /mcp/** anonymous and the controller carries no permission annotation. An unauthenticated caller retrieves field names, types, required flags, default values, options, validation rules and binding sources for CRM modules. The failure mode is worth naming: a blanket path prefix exemption added to make an MCP endpoint reachable by an agent also made it reachable by everyone.

Graph relationships

USES
CordysCRM
CordysCRM uses Shiro's ShiroFilter for authentication, leaving /mcp endpoints unauthenticated.
Source finding
USES
CordysCRM -> Shiro
CordysCRM uses Shiro's ShiroFilter for authentication, leaving /mcp endpoints unauthenticated.
Source finding

Source trail

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues