CVE-2026-76900

Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.7.4

Description An issue exists where the sendWebHook function in ApprovalResourceService reads the webHookUrl variable from the WebHookConfig and passes it to HttpClientUtils via ApprovalFlowService.updateApprovalPostField without performing Server-Side Request Forgery (SSRF) validation. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. A user with PROCESS SETTING ADD permissions can configure an internal URL through the 'POST /approval-flow/add' endpoint. When the 'POST /approval-action/approve' endpoint executes the approval action, the server requests the configured URL, potentially allowing cloud metadata access, internal network reconnaissance, and interaction with reachable internal services.

Recommendations Update to version 1.7.4. Restrict access to the 'POST /approval-flow/add' endpoint to trusted users only.