CVE-2026-16223

Name of the Vulnerable Software and Affected Versions 1Panel-dev CordysCRM versions prior to 1.4.2

Description An issue exists in the Third Party Edit Endpoint where the getSqlBotSrc() function within the backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java file does not properly handle the appSecret argument. This allows a remote attacker to perform server-side request forgery (SSRF), a technique where the server is tricked into making unauthorized requests to internal or external resources.

Recommendations Update 1Panel-dev CordysCRM to version 1.4.2 or later. As a temporary mitigation, restrict access to the Third Party Edit Endpoint or avoid using the appSecret argument until the update is applied.