CVE-2026-76900

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-76900
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76900.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-76900
Aliases
  • GHSA-fg6q-pfj7-fghw
Published
2026-09-18T19:56:53Z
Modified
2026-10-28T11:17:50Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
Details

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76900.json"
}
References

Affected packages

Git / github.com/1panel-dev/cordyscrm

Affected ranges

Type
GIT
Repo
https://github.com/1panel-dev/cordyscrm
Events
Introduced
fa2008cd5c1dfd9edafcd2718e3e7b1b30d7b70e
Fixed
e0ae23ebf16faa062204d90a689fe33496541ada
Fixed
83bd0bf7422c0391af6c2f798f62c624a056bf6b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "= 1.7.3"
                },
                {
                    "last_affected":  "= 1.7.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        },
        {
            "range":  [
                {
                    "fixed":  "e0ae23ebf16faa062204d90a689fe33496541ada"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.7.4",
            "range":  [
                {
                    "fixed":  "83bd0bf7422c0391af6c2f798f62c624a056bf6b"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

= 1.*
= 1.7.3
v1.*
v1.7.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76900.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "83347479842033023200515311569223989141",
                "232436553629168511290127159040357577274",
                "29794471155429257072471956569261852179",
                "248228210090909829887201180162498735667"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-76900-11799a1f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/1panel-dev/cordyscrm/commit/e0ae23ebf16faa062204d90a689fe33496541ada",
        "target":  {
            "file":  "backend/crm/src/main/java/cn/cordys/crm/approval/service/ApprovalResourceService.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "184841500500836189106785970759942065275",
            "length":  225
        },
        "id":  "CVE-2026-76900-4f134b57",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/1panel-dev/cordyscrm/commit/e0ae23ebf16faa062204d90a689fe33496541ada",
        "target":  {
            "file":  "backend/crm/src/main/java/cn/cordys/crm/integration/common/utils/HttpClientUtils.java",
            "function":  "doGet"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "260394009816963612633631722237985365919",
            "length":  366
        },
        "id":  "CVE-2026-76900-64c77a7d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/1panel-dev/cordyscrm/commit/e0ae23ebf16faa062204d90a689fe33496541ada",
        "target":  {
            "file":  "backend/crm/src/main/java/cn/cordys/crm/integration/common/utils/HttpClientUtils.java",
            "function":  "doPost"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "127208227295543301795666630741110571930",
            "length":  532
        },
        "id":  "CVE-2026-76900-767dd695",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/1panel-dev/cordyscrm/commit/e0ae23ebf16faa062204d90a689fe33496541ada",
        "target":  {
            "file":  "backend/crm/src/main/java/cn/cordys/crm/approval/service/ApprovalResourceService.java",
            "function":  "testConnect"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "297035554684689859976900268137718555754",
                "170303434073081179366561086831023795378",
                "45846805413225389400126786608722788331",
                "137435120986061611741588412491777321525",
                "269534725956125332894559569595136165384",
                "117988473800182647043574568235015816399"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-76900-c81882a1",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/1panel-dev/cordyscrm/commit/83bd0bf7422c0391af6c2f798f62c624a056bf6b",
        "target":  {
            "file":  "backend/crm/src/main/java/cn/cordys/crm/follow/service/BaseFollowUpService.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "320144658412324829475839133206321393830",
            "length":  1596
        },
        "id":  "CVE-2026-76900-c823bc9d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/1panel-dev/cordyscrm/commit/83bd0bf7422c0391af6c2f798f62c624a056bf6b",
        "target":  {
            "file":  "backend/crm/src/main/java/cn/cordys/crm/follow/service/BaseFollowUpService.java",
            "function":  "checkRecordPermission"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "6676533185429243244927831076574166788",
            "length":  385
        },
        "id":  "CVE-2026-76900-ecf3245d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/1panel-dev/cordyscrm/commit/e0ae23ebf16faa062204d90a689fe33496541ada",
        "target":  {
            "file":  "backend/crm/src/main/java/cn/cordys/crm/integration/common/utils/HttpClientUtils.java",
            "function":  "doRequest"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "185992869145333188575981771805281620251",
                "270995742882537167917212331056064961908",
                "334988732523916493997156563072192428946",
                "210135241255791285182669644070474867023",
                "77794745228821641220698530174996345506",
                "231259006915017793668056681148784841205",
                "239289206940348217040924035931985068000",
                "311903432155823686594707926861754528491",
                "151866465650026841772817467309540664665",
                "137668311219600352713749684355799743177",
                "77491854300973072079983434016115971957",
                "290688300051209560037505197133346705753",
                "25654755642087251397589270072338281551"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-76900-f5dbe414",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/1panel-dev/cordyscrm/commit/e0ae23ebf16faa062204d90a689fe33496541ada",
        "target":  {
            "file":  "backend/crm/src/main/java/cn/cordys/crm/integration/common/utils/HttpClientUtils.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:17:50Z"