CVE-2026-76900: fallo de gravedad media en 1Panel-dev CordysCRM
CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.8epss 0.5%
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Productos afectados
1Panel-dev · CordysCRMCVEs relacionadas — 1Panel-dev CordysCRM
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-63646MEDIUMCordysCRM MCP Form Configuration Endpoint Exposed to Anonymous UsersEPSS 0.7%CVE-2026-63647CRITICALCordysCRM SSE Notification Stream Hijack via `/sse/subscribe`EPSS 0.5%CVE-2026-76901MEDIUMCordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accountsEPSS 0.4%CVE-2026-76899MEDIUMCordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`EPSS 0.4%CVE-2026-16223MEDIUM1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgeryEPSS 0.4%CVE-2026-16222MEDIUM1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgeryEPSS 0.4%