CVE-2026-108702: Missing Authorization in 1Panel-dev CordysCRM

The vulnerability in 1Panel-dev CordysCRM (up to version 1.9.3) is due to the lack of a PROCESS_SETTING permission check on the POST /approval-flow/webhook/test endpoint. Authenticated users can exploit this to cause the server to make requests to URLs supplied by the attacker. This behavior enables attackers to redirect GET requests from a controlled host, bypass the SSRFValidator, and probe internal addresses by analyzing success or failure responses.

An authenticated attacker can abuse this missing authorization to perform server-side request forgery (SSRF) attacks, potentially allowing internal network reconnaissance. The vulnerability does not require user interaction and has a CVSS 4.0 base score of 5.3 (medium severity). There is no indication of remote code execution or data exfiltration beyond SSRF-based probing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to the affected endpoint and monitor for unusual request patterns. Implement additional validation or filtering on URLs accepted by the webhook endpoint to prevent SSRF exploitation.