CVE-2026-110100

MEDIUM 5.4

Jorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse get_headers() and fopen() for server-side request forgery against internal hosts.

CWE	CWE-862
Vendor	jorani
Product	jorani
Published	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for jorani jorani

Be the first to know when new medium vulnerabilities affecting jorani jorani are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

Jorani / Jorani

0 < 1.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/jorani/jorani/issues/426 github.com: https://github.com/jorani/jorani/blob/v1.0.2/application/controllers/Contracts.php#L358-L375 github.com: https://github.com/jorani/jorani/commit/59c403224401824489ec662934f71c90d27f614c github.com: https://github.com/jorani/jorani/releases/tag/v1.0.4 vulncheck.com: https://www.vulncheck.com/advisories/jorani-before-1.0.4-missing-authorization-and-ssrf-via-contracts-import

Credits

lighthousekeeper1212 🔍 leediay153 from Viettel Post