Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-76900— CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime

Quick assessment

Affected
1Panel-dev CordysCRM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

CordysCRM 是一个支持私有部署的开源 AI 驱动客户关系管理系统。在 1.7.3 版本中， 从已存储的审批节点配置中读取 ，并通过 将其传递给 ，但未经过可选的 路径所使用的 SSRF（服务端请求伪造）验证。拥有 权限的用户可以通过 接口配置一个内部 URL，并在执行 触发审批操作时，促使服务器向该内部 URL 发起请求，从而实现对云元数据服务的访问、内部网络侦察以及与可达内部服务的交互。该问题已在 1.7.4 版本中修复。

CVSS 6.8 · Medium EPSS 0.50% · P43

Affected Version Matrix 1

VendorProduct Version RangeStatus
1Panel-dev CordysCRM = 1.7.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76900

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
Source: CVE Program / CVE List V5
Vulnerability Description
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
1Panel-dev CordysCRM = 1.7.3 -

II. Public POCs for CVE-2026-76900

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76900

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-76900 (2)

Other References for CVE-2026-76900 (2)

Same Patch Batch · 1Panel-dev · 2026-09-18 · 7 CVEs total

CVE-2026-63647 9.3 CRITICAL CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
CVE-2026-63646 6.9 MEDIUM CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users
CVE-2026-76901 5.8 MEDIUM CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoint
CVE-2026-76899 5.7 MEDIUM CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
CVE-2026-52745 5.3 MEDIUM CordysCRM: Customer Public Pool Sorting Field SQL Injection
CVE-2026-76902 5.0 MEDIUM CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/

IV. Related Vulnerabilities

Same product: CordysCRM
Same vendor: 1Panel-dev
Same weakness: CWE-918