Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 16:58:23 +0000 CVE-2026-108702 — CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test https://vulnerability.circl.lu/vuln/cve-2026-108702 <p><strong>Affected:</strong> 1Panel-dev CordysCRM</p> <p>1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe internal addresses through success or failure results.</p> <p><strong>Affected:</strong> 1Panel-dev CordysCRM</p> <p>1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled host to bypass SSRFValidator and probe internal addresses through success or failure results.</p> https://vulnerability.circl.lu/vuln/cve-2026-108702