CVE-2026-16223
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
SSRF vulnerability in 1Panel-dev CordysCRM up to version 1.4.1 in the getSqlBotSrc function of IntegrationConfigService.java. A remote attacker can manipulate the appSecret argument, leading to HTTP requests to arbitrary internal resources.
Risk Assessment
Risk includes internal network scanning, access to internal services, and potential privilege escalation or data disclosure.
Recommendation
Upgrade CordysCRM to a version above 1.4.1 immediately and validate/restrict the appSecret argument in integration configuration.
Other vulnerabilities in CordysCRM
See all- CVE-2026-16222Medium
A server-side request forgery (SSRF) vulnerability was found in the Third Party Endpoint component of CordysCRM up to version 1.4.1. The issue occurs in the TokenService.java file, where manipulation of the mkAddress argument allows remote attack execution. The project closed the report, stating it is not the official way to report a security vulnerability.
- CVE-2026-10567Low
A cross-site scripting vulnerability was found in CordysCRM up to version 1.4.1 in the Save function of ModuleFormService.java. Manipulation of the Description argument allows remote XSS attacks. The exploit has been publicly disclosed.
- CVE-2026-10514Low
A cross-site scripting vulnerability was found in CordysCRM up to version 1.6.2 in the file RequestParamTrimConfig.java. Remote attack is possible. Patch available in version 1.7.0.
Original NVD description (English source)
A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.