CVE-2026-110100: Jorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()
Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse getheaders() and fopen() for server-side request forgery against internal hosts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Jorani user can exploit it. The attacker does not need authorization over the targeted contract.
What access and input does an attacker need?
The attacker needs a valid authenticated account and the ability to send a POST request containing a contract ID and a URL. They can use this to import days-off data into another contract and cause the server to request the supplied URL.
What is the practical impact on contract calendars?
An attacker can overwrite the non-working-day calendar for any contract by importing days-off data. This can alter availability or leave-management calendar data associated with contracts.
What systems may be reachable through the SSRF behavior?
The vulnerable code uses get_headers() and fopen() on an attacker-supplied URL, so the Jorani server can be induced to make requests to internal hosts that may not be directly accessible to the attacker.