Is CVE-2026-76900 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76900 being exploited in the wild.

How severe is CVE-2026-76900?

Medium severity, with a CVSS score of 6.8, published 18 September 2026.

Is there a fix for CVE-2026-76900?

A patch was published on 2026-07-09: Version 1.7.4 includes SSRF validation fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76900 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-76900?

Check whether you run 1Panel CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76900: CordysCRM SSRF in approval workflow configuration

CVE-2026-76900 · Severity: medium · CVSS 6.8 · Published 2026-09-18

CordysCRM is an open source AI-powered customer relationship management system. A user with approval process configuration permissions can inject internal URLs that the server will request when approval actions are executed, enabling attackers to access cloud metadata, scan internal networks, and interact with internal services that would otherwise be unreachable.

Technologies: 1Panel CordysCRM. Vendors: 1Panel.

Quick answers

Is CVE-2026-76900 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76900 being exploited in the wild.
How severe is CVE-2026-76900?: Medium severity, with a CVSS score of 6.8, published 18 September 2026.
Which products and versions are affected?: 1Panel CordysCRM 1.7.3.
Is there a fix for CVE-2026-76900?: A patch was published on 2026-07-09: Version 1.7.4 includes SSRF validation fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76900 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-76900?: Check whether you run 1Panel CordysCRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Server-Side Request Forgery (SSRF) vulnerability in ApprovalResourceService.sendWebHook lacks input validation on webhook URLs read from stored approval configuration, unlike the optional testConnect path which includes SSRF protections. An authenticated attacker with PROCESS_SETTING_ADD permission can exploit this via POST /approval-flow/add to configure malicious URLs and POST /approval-action/approve to trigger requests to internal targets.

Affected products

1Panel CordysCRM 1.7.3

Timeline

2026-09-18: disclosed
2026-07-09: patched: Version 1.7.4 includes SSRF validation fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.