CVE-2026-16222
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A server-side request forgery (SSRF) vulnerability was found in the Third Party Endpoint component of CordysCRM up to version 1.4.1. The issue occurs in the TokenService.java file, where manipulation of the mkAddress argument allows remote attack execution. The project closed the report, stating it is not the official way to report a security vulnerability.
Risk Assessment
An attacker can exploit this vulnerability to send requests from the server to internal network resources, potentially leading to exposure of sensitive data or escalation of attacks on other systems.
Recommendation
Immediately update CordysCRM to a version newer than 1.4.1 if available, or apply temporary mitigations such as filtering addresses in the mkAddress argument.
Other vulnerabilities in CordysCRM
See all- CVE-2026-16223Medium
SSRF vulnerability in 1Panel-dev CordysCRM up to version 1.4.1 in the getSqlBotSrc function of IntegrationConfigService.java. A remote attacker can manipulate the appSecret argument, leading to HTTP requests to arbitrary internal resources.
- CVE-2026-10567Low
A cross-site scripting vulnerability was found in CordysCRM up to version 1.4.1 in the Save function of ModuleFormService.java. Manipulation of the Description argument allows remote XSS attacks. The exploit has been publicly disclosed.
- CVE-2026-10514Low
A cross-site scripting vulnerability was found in CordysCRM up to version 1.6.2 in the file RequestParamTrimConfig.java. Remote attack is possible. Patch available in version 1.7.0.
Original NVD description (English source)
A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file backend/crm/src/main/java/cn/cordys/crm/integration/sso/service/TokenService.java of the component Third Party Endpoint. Performing a manipulation of the argument mkAddress results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability.