{"id":"CVE-2026-76900","summary":"CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime","details":"CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.","aliases":["GHSA-fg6q-pfj7-fghw"],"modified":"2026-09-19T11:45:35.842232338Z","published":"2026-09-18T19:56:53.620Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76900.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-918"]},"references":[{"type":"FIX","url":"https://github.com/1Panel-dev/CordysCRM/commit/e0ae23ebf16faa062204d90a689fe33496541ada"},{"type":"FIX","url":"https://github.com/1Panel-dev/CordysCRM/pull/2966"},{"type":"WEB","url":"https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4"},{"type":"ADVISORY","url":"https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76900.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76900"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/1panel-dev/cordyscrm","events":[{"introduced":"fa2008cd5c1dfd9edafcd2718e3e7b1b30d7b70e"},{"last_affected":"fa2008cd5c1dfd9edafcd2718e3e7b1b30d7b70e"}],"database_specific":{"extracted_events":[{"introduced":"= 1.7.3"},{"last_affected":"= 1.7.3"}],"source":"AFFECTED_FIELD"}}],"versions":["= 1.7.3","v1.7.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76900.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N"}]}