CVE-2026-76900

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.

• CWE-918

• https://github.com/1Panel-dev/CordysCRM/commit/e0ae23ebf16faa062204d90a689fe33496541ada
• https://github.com/1Panel-dev/CordysCRM/pull/2966
• https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4
• https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw
• https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw

Published

Sep 18, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7689A security flaw has been discovered in Dolibarr ERP CRM up t…3.7
• CVE-2026-76890Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows…6.5
• CVE-2026-76891Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows…6.5
• CVE-2026-76898draw.io is a configurable diagramming and whiteboarding appl…7.7
• CVE-2026-76899CordysCRM is an open source AI-powered customer relationship…5.7
• CVE-2026-7690A weakness has been identified in Wavlink WL-WN570HA1 R70HA1…9.8
• CVE-2026-76901CordysCRM is an open source AI-powered customer relationship…5.8
• CVE-2026-76902CordysCRM is an open source AI-powered customer relationship…5
• CVE-2026-76904GeoTools is an open source Java library that provides tools …9.8
• CVE-2026-76905kin-openapi is a Go project for handling OpenAPI files. From…7.5
• CVE-2026-76907LaSuite Doc is a collaborative note taking, wiki and documen…6.5
• CVE-2026-76909Unleash is an open-source feature management platform. Prior…2.1