CVE-2026-108702: CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESSSETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe internal addresses through success or failure results.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated CordysCRM user can exploit the affected endpoint because it does not enforce the PROCESS_SETTING permission check. No user interaction is required.
What access and input does an attacker need?
The attacker needs a valid authenticated account and the ability to submit a URL to POST /approval-flow/webhook/test. They can use a controlled host that redirects GET requests to internal target addresses.
What can an attacker learn or do through the SSRF?
The issue allows server-side requests to attacker-supplied destinations and can be used to probe internal addresses. The described behavior is blind SSRF: success or failure results reveal whether requests to targets succeeded.
Are installations running version 1.9.3 affected?
Yes. The affected range is CordysCRM through version 1.9.3, which includes 1.9.3.