CVE-2026-108702 Overview
CVE-2026-108702 is a missing authorization vulnerability [CWE-862] in 1Panel-dev CordysCRM through version 1.9.3. The flaw affects the POST /approval-flow/webhook/test endpoint, which lacks a required PROCESS_SETTING permission check. Any authenticated user can trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass the SSRFValidator and probe internal network addresses through observable success or failure results, enabling a blind Server-Side Request Forgery (SSRF) attack.
Critical Impact
Authenticated attackers can abuse the webhook test endpoint to map internal network services and bypass SSRF protections through redirect-based evasion.
Affected Products
- 1Panel-dev CordysCRM through version 1.9.3
- CordysCRM ApprovalFlowController webhook test functionality
- Deployments exposing the /approval-flow/webhook/test endpoint to authenticated users
Discovery Timeline
- 2026-10-11 - CVE-2026-108702 published to NVD
- 2026-10-11 - Last updated in NVD database
Technical Details for CVE-2026-108702
Vulnerability Analysis
The vulnerability resides in the ApprovalFlowController of CordysCRM. The POST /approval-flow/webhook/test route is intended to validate webhook endpoints during approval-flow configuration. The route handler omits the PROCESS_SETTING permission check, so any authenticated principal, regardless of role, can invoke it. The server then issues an outbound HTTP GET request to the URL supplied in the request body.
CordysCRM applies an SSRFValidator to the initial URL to block requests targeting private or loopback addresses. However, the validator only inspects the submitted URL and does not re-validate the destination after HTTP redirects. An attacker hosts a public endpoint that responds with a 302 redirect to an internal address such as http://127.0.0.1:8080 or http://169.254.169.254. The HTTP client follows the redirect and issues the GET request to the internal target.
Response timing and status differences allow the attacker to infer whether the internal host and port are reachable, producing a blind SSRF primitive useful for internal reconnaissance and cloud metadata probing.
Root Cause
Two defects combine to produce the issue. First, authorization enforcement is missing on the webhook test handler, violating the principle of least privilege for the approval-flow configuration surface. Second, the SSRF defense validates only the user-submitted URL and trusts the HTTP client to maintain policy across redirects, leaving a time-of-check to time-of-use gap.
Attack Vector
Exploitation requires network access to the CordysCRM web interface and valid low-privileged credentials. The attacker submits a crafted JSON body to POST /approval-flow/webhook/test referencing an attacker-controlled URL. The attacker's server responds with a redirect to the chosen internal target. The attacker observes the HTTP response, timing, or error message returned by CordysCRM to determine whether the internal destination accepted the connection. See the VulnCheck Advisory on CordysCRM and the public proof-of-concept script for technical details.
Detection Methods for CVE-2026-108702
Indicators of Compromise
- Unexpected POST requests to /approval-flow/webhook/test from user accounts without approval-flow administration duties.
- Outbound HTTP GET requests from CordysCRM backend hosts to external domains followed quickly by connections to RFC1918 or link-local addresses.
- Repeated webhook test submissions referencing the same external host, consistent with scripted probing.
Detection Strategies
- Alert on HTTP access logs where the CordysCRM backend issues GET requests to 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 169.254.169.254 shortly after a webhook test call.
- Correlate application audit logs for /approval-flow/webhook/test with the invoking user's role; flag calls from accounts that lack PROCESS_SETTING.
- Detect redirect chains originating from the CordysCRM egress IP that terminate at internal services.
Monitoring Recommendations
- Forward CordysCRM application logs and host network telemetry to a centralized SIEM for correlation of authorization decisions with outbound requests.
- Baseline the normal set of webhook destinations and alert on first-seen external hosts targeted by the test endpoint.
- Monitor cloud instance metadata service (IMDS) access attempts from the CordysCRM workload identity.
How to Mitigate CVE-2026-108702
Immediate Actions Required
- Restrict network access to the CordysCRM web interface to trusted administrators until a patched release is deployed.
- Review user accounts and remove unnecessary authenticated access to the application.
- Block egress from the CordysCRM backend to internal management ranges and cloud metadata endpoints at the network layer.
Patch Information
No fixed version is published in the NVD record at the time of writing. The vulnerability affects CordysCRM through 1.9.3. Monitor the 1Panel-dev CordysCRM repository and the VulnCheck Advisory on CordysCRM for the fixed release.
Workarounds
- Place CordysCRM behind a reverse proxy that denies POST /approval-flow/webhook/test for users outside the approval-flow administrator group.
- Configure the backend HTTP client to disable automatic redirect following, or revalidate the redirect target against the SSRF allow list before issuing follow-up requests.
- Deploy an egress proxy that restricts outbound HTTP from CordysCRM to an explicit allow list of approved webhook destinations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
