CVE-2026-76900

Overview

CVE-2026-76900 is a Server‑Side Request Forgery (SSRF) flaw in CordysCRM 1.7.3 that allows a privileged user to trigger outbound HTTP requests to arbitrary internal URLs via the ApprovalResourceService.sendWebHook endpoint. The vulnerability can expose cloud metadata, perform internal network reconnaissance, and interact with internal services. It is mitigated in CordysCRM 1.7.4.

Description

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.

Impact

Confidentiality: attackers can discover internal network topology and sensitive data via cloud metadata. Integrity: internal services may be manipulated through crafted requests. Availability: minimal direct impact. Defenders: system administrators, network security teams, and application security teams.

Remediation

Upgrade CordysCRM to version 1.7.4 or later. If upgrade is not possible, restrict the PROCESS_SETTING_ADD role to trusted users, block outbound requests to internal IP ranges via firewall or proxy, and validate URLs before sending them to HttpClientUtils.

Risk context

Medium severity CVE-2026-76900; no EPSS data available; moderate risk to internal network if not patched or mitigated.

Affected products

• CordysCRM 1.7.3