Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M

CVE-2026-76900CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime

Medium 6.8

In plain English

A medium-severity server-side request forgery in CordysCRM from 1Panel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.

Affected products (as reported)

Vendor	Product	Versions
1Panel-dev	CordysCRM	= 1.7.3

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw x_refsource_CONFIRM
https://github.com/1Panel-dev/CordysCRM/pull/2966 x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/commit/e0ae23ebf16faa062204d90a689fe33496541ada x_refsource_MISC
https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4 x_refsource_MISC