CVE-2026-16222mediumCWE-918

CVE-2026-16222: medium-severity vulnerability in 1Panel-dev CordysCRM

1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery

Published · Updated

Follow this CVE+ Monitor CordysCRM

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.4%
A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
1Panel-dev · CordysCRM
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — 1Panel-dev CordysCRM

In the same product, most dangerous first.

CVE-2026-63646MEDIUMCordysCRM MCP Form Configuration Endpoint Exposed to Anonymous UsersEPSS 0.7%CVE-2026-76900MEDIUMCordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at RuntimeEPSS 0.5%CVE-2026-63647CRITICALCordysCRM SSE Notification Stream Hijack via `/sse/subscribe`EPSS 0.5%CVE-2026-76901MEDIUMCordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accountsEPSS 0.4%CVE-2026-76899MEDIUMCordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`EPSS 0.4%CVE-2026-16223MEDIUM1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgeryEPSS 0.4%