CVE-2026-76900: CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESSSETTINGADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CordysCRMto a version that resolves this vulnerability.Fixed in 1.7.4 - Compensating control
Restrict outbound network egress from the CordysCRM application/server (e.g., only allow approved destinations) to limit the ability of the Approval Flow webhook execution (POST /approval-action/approve) to reach cloud metadata, internal networks, or internal services when WebHookConfig.webHookUrl is attacker-controlled.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the PROCESS_SETTING_ADD permission can create an approval-flow node whose webhook URL targets an internal or otherwise restricted address. The request is sent when an approval action is executed.
Does exploitation require the optional webhook connection test?
No. The vulnerable runtime path is ApprovalResourceService.sendWebHook during approval execution, not the optional testConnect path. The testConnect path has SSRF validation, but the approval execution path described does not.
What can an attacker do through the vulnerable webhook?
They can cause the CordysCRM server to make requests to reachable internal services or cloud metadata endpoints. This can enable internal network reconnaissance, interaction with internal services, and access to cloud metadata.
What should be done if upgrading cannot happen immediately?
Restrict PROCESS_SETTING_ADD to only trusted administrators and review approval-flow configurations for webhook URLs pointing to internal, loopback, link-local, or cloud metadata addresses. Limit the server's outbound network access so it cannot reach sensitive internal services or metadata endpoints.
Which version fixes the issue?
The issue is fixed in CordysCRM version 1.7.4. The affected version identified in the advisory is 1.7.3.