CVE-2026-76900
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment.
Impact
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/1Panel-dev/CordysCRM/commit/e0ae23ebf16faa062204d90a689fe33496541ada
- https://github.com/1Panel-dev/CordysCRM/pull/2966
- https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4
- https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw
- https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw