EUVD-2026-83371Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Network SSRF triggered via app workflow, so AV:N/AC:L; requires a delegated PROCESS_SETTING_ADD grant (PR:L, arguably PR:H); metadata/credential read gives C:H with scope change, no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.
AnalysisAI
CordysCRM 1.7.3 and earlier allows an authenticated user holding the PROCESS_SETTING_ADD permission to store an attacker-chosen webhook URL in an approval-flow node and then cause the server to issue outbound HTTP requests to that URL when an approval action is approved, turning the application into a proxy for reaching internal-only services. The assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - high confidentiality impact against the attacked component with no integrity or availability impact - and the practical payoff is cloud metadata access (for example 169.254.169.254) and internal network reconnaissance, bounded by the server's network reach and by the multi-step trigger (configure via POST /approval-flow/add, fire via POST /approval-action/approve). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account holding the PROCESS_SETTING_ADD permission to create/edit an approval flow (POST /approval-flow/add) with a webhook node containing an attacker-chosen webHookUrl. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority SSRF (CWE-918) in CordysCRM 1.7.3, confirmed by the vendor advisory GHSA-fg6q-pfj7-fghw, the fixing PR #2966, commit e0ae23e, and the v1.7.4 release tag - the patch diff directly corroborates the root cause (the SSRF validation call was absent from the webhook send path and centralized SSRF validation was added inside HttpClientUtils). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to CordysCRM 1.7.4 (https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.4), which centralizes SSRF validation inside HttpClientUtils per PR https://github.com/1Panel-dev/CordysCRM/pull/2966 and commit https://github.com/1Panel-dev/CordysCRM/commit/e0ae23ebf16faa062204d90a689fe33496541ada; apply the advisory guidance at https://github.com/1Panel-dev/CordysCRM/security/advisories/GHSA-fg6q-pfj7-fghw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
CordysCRM before 1.7.2 exposes its SSE notification endpoints anonymously, allowing a remote unauthenticated attacker wh
Unauthenticated information disclosure in CordysCRM (1Panel-dev) versions prior to 1.7.2 lets any network-reachable call
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerc
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to m
Stored cross-site scripting in CordysCRM (1Panel-dev, versions up to 1.4.1) allows an authenticated remote attacker to i
Broken object-level authorization (IDOR/BOLA) in CordysCRM allows any authenticated user holding the ordinary CLUE_MANAG
Error-based SQL injection in CordysCRM 1.7.0 through pre-1.7.4 lets an authenticated user holding the MODULE_SETTING_UPD
Time-based blind SQL injection in CordysCRM versions prior to 1.7.0 allows an authenticated attacker holding the MODULE_
Unauthenticated tenants can read other organizations' uploaded files in CordysCRM (1Panel-dev) versions prior to 1.7.4,
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today