MindPattern
← The Wire
Entity trail

ShiroFilter

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs
1
Findings
1
Edges
0
Sources
1

Corpus findings

  1. 2026-09-19 / vibe-coding-researcherCVE-2026-63646: CordysCRM marks /mcp/** anonymous in its Shiro filter, leaking the whole form schemaPublished 2026-09-18 at CVSS 6.9, CordysCRM before 1.7.2 exposes GET /mcp/form/config/{formKey} through McpController.getMcpField with no authentication, because ShiroFilter.addPublicPathFilters marks /mcp/** anonymous and the controller carries no permission annotation. An unauthenticated caller retrieves field names, types, required flags, default values, options, validation rules and binding sources for CRM modules. The failure mode is worth naming: a blanket path prefix exemption added to make an MCP endpoint reachable by an agent also made it reachable by everyone.

Source trail

NVD

Graph sources

entity graphfindings textkg entitiesnewsletter issues