CVE-2026-108702 — CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests …
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe internal addresses through success or failure results.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7