SSRF in 1panel-Dev Cordyscrm
CVE-2026-76900
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.
Vulnerability class: SSRF (Server-Side Request Forgery)
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N.
Affected products
- 1panel-dev Cordyscrm — versions = 1.7.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-76900?
- CVE-2026-76900 is a medium-severity vulnerability in 1panel-Dev Cordyscrm, classified under Server-Side Request Forgery (SSRF). CVSS score: 6.8/10. Published 2026-09-18.
- How severe is CVE-2026-76900?
- Medium severity. CVSS v3 base score is 6.8 out of 10.