PT-2026-24807 · Git+2 · Openproject

Adilburak + 1 · Published 2026-03-11 · Updated 2026-03-19 · CVE-2026-31974

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.2.0

Description OpenProject is a web-based project management software. Prior to version 17.2.0, the SMTP test endpoint, accessible via the ''POST /admin/settings/mail notifications'' API endpoint, accepts arbitrary host and port values. This allows an attacker with access to map internal hosts and identify reachable services and ports through timing and error differences in the response. Similarly, creating webhooks pointing to arbitrary IPs results in a Server-Side Request Forgery (SSRF) issue, enabling attackers to scan the internal network. The host and port parameters of the SMTP test endpoint are vulnerable.

Recommendations Versions prior to 17.2.0 should be updated to version 17.2.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-31974

GHSA-9WR7-J98G-2JH3

Affected Products

Openproject

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31974.json · Exploit
• https://github.com/opf/openproject/security/advisories/GHSA-9wr7-j98g-2jh3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31974 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31974 · Vendor Advisory
• https://twitter.com/CVEnew/status/2031867670690140265 · Twitter Post
• https://twitter.com/drak3hft7/status/2031728121666244612 · Twitter Post
• https://twitter.com/adilburaksen/status/2034602590538019146 · Twitter Post