CVE-2026-76900 in CordysCRM
Summary
by MITRE • 09/18/2026
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through ApprovalFlowService.updateApprovalPostField to HttpClientUtils without the SSRF validation used by the optional testConnect path. A user with PROCESS_SETTING_ADD can configure an internal URL through POST /approval-flow/add and cause the server to request it when POST /approval-action/approve executes the approval action, enabling cloud metadata access, internal network reconnaissance, and interaction with reachable internal services. This issue is fixed in version 1.7.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
CordysCRM represents an open-source customer relationship management platform that leverages artificial intelligence to facilitate private deployment scenarios for enterprise data handling. In the specific context of version 1.7.3, a critical server-side request forgery vulnerability exists within the approval workflow subsystem. The flaw is located in the ApprovalResourceService.sendWebHook method, which interacts with stored configuration data from approval nodes. Specifically, this service retrieves the web hook URL defined in WebHookConfig.webHookUrl and forwards it to HttpClientUtils via the ApprovalFlowService.updateApprovalPostField function for execution. This architectural design allows external inputs to dictate outbound network requests made by the server itself, creating a potential vector for abuse if input validation is insufficient.
The core technical deficiency lies in the inconsistent application of security controls during different operational paths within the same service module. While the optional testConnect path includes Server-Side Request Forgery mitigation checks, the primary execution flow triggered when POST /approval-action/approve executes an approval action lacks these validations. Consequently, a user possessing PROCESS_SETTING_ADD privileges can manipulate the system by submitting a crafted request to POST /approval-flow/add. This allows them to configure an internal URL as part of the approval-node configuration without triggering any server-side validation mechanisms that would typically block requests targeting local or private network addresses.
The operational impact of this vulnerability is significant, particularly in environments where CordysCRM processes sensitive business data and interacts with other internal systems. By exploiting this flaw, an authenticated attacker can force the application server to initiate HTTP requests to arbitrary destinations within the organization's internal network topology. This capability enables cloud metadata access, allowing attackers to retrieve instance identity credentials or configuration details from cloud provider endpoints such as AWS EC2 or Azure Managed Identity services. Furthermore, it facilitates comprehensive internal network reconnaissance by probing for open ports and running services on private IP ranges that are not exposed to the public internet but remain accessible via the compromised server's network interface.
Beyond passive discovery, this vulnerability permits active interaction with reachable internal services. Attackers can craft requests to interact with vulnerable web applications, database management interfaces, or administrative consoles located within the trusted network perimeter. This effectively bypasses traditional perimeter security controls that rely on IP-based restrictions, as the malicious traffic originates from a legitimate and trusted server identity. The ability to pivot through these SSRF-induced connections can lead to further compromise of internal assets, data exfiltration, or lateral movement across the enterprise network infrastructure.
To mitigate this risk, organizations running CordysCRM version 1.7.3 must immediately upgrade to version 1.7.4, where the developers have addressed the missing validation logic in the approval action execution path. Until an update is applied, administrators should enforce strict role-based access control policies to limit PROCESS_SETTING_ADD privileges to only those users who absolutely require them for business operations. Additionally, implementing network segmentation and egress filtering rules can restrict outbound connections from application servers to known whitelisted domains or IP ranges, thereby reducing the attack surface available to an attacker attempting to leverage this SSRF condition. Monitoring outbound traffic patterns from CRM server instances may also aid in early detection of such exploitation attempts by identifying unusual connection destinations or high-frequency requests to internal subnets.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery and is associated with MITRE ATT&CK technique T1557 which covers Adversary-in-the-Middle scenarios involving credential harvesting through cloud metadata endpoints. The lack of input validation on user-controlled data used to construct outbound requests highlights a common pattern in web application development where security checks are inconsistently applied across different code paths within the same functional module. Ensuring consistent security controls across all execution branches is essential for maintaining robust defense-in-depth strategies against such logic-based vulnerabilities.