A security vulnerability has been detected in DefaultFuction Jeson-Customer-Relationship-Management-System up to 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. This …

CVE-2026-4623 affects DefaultFuction Jeson-Customer-Relationship-Management-System up to commit 1b4679c4d06b90d31dd521c2b000bfdec5a36e00. The vulnerability exists in an unknown function of the file /api/System.php within the API Module component. Manipulation of the 'url' argument leads to server-side request forgery (SSRF). The attack can be initiated remotely and the exploit has been publicly disclosed. The product uses continuous delivery with rolling releases, making version tracking difficult. A patch has been made available with identifier f76e7123fe093b8675f88ec8f71725b0dd186310/98bd4eb07fa19d4f2c5228de6395580013c97476. Organizations are advised to apply the patch immediately to address this remotely exploitable vulnerability.