CVE-2026-63646: CordysCRM marks /mcp/** anonymous in its Shiro filter, leaking the whole form schema

NVD·low signalXBlueskyLinkedInCopy link

Published 2026-09-18 at CVSS 6.9, CordysCRM before 1.7.2 exposes GET /mcp/form/config/{formKey} through McpController.getMcpField with no authentication, because ShiroFilter.addPublicPathFilters marks /mcp/** anonymous and the controller carries no permission annotation. An unauthenticated caller retrieves field names, types, required flags, default values, options, validation rules and binding sources for CRM modules. The failure mode is worth naming: a blanket path prefix exemption added to make an MCP endpoint reachable by an agent also made it reachable by everyone.