Missing Authorization Vulnerability in Jorani Software by Jorani
CVE-2026-110100

5.3MEDIUM

Key Information:

Vendor

Jorani

Status
Jorani
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110100?

The Jorani software, prior to version 1.0.4, is exposed to a missing authorization vulnerability within the Contracts::import() function. This flaw enables any authenticated user to manipulate contract data by importing days off from arbitrary URLs. The publicly accessible functionality can lead to server-side request forgery (SSRF), allowing attackers to potentially access internal resources by sending crafted POST requests with a specific contract id and URL, thus overwriting non-working-day calendars. Mitigation is advised through updating to the latest released version.

Affected Version(s)

Jorani 0 < 1.0.4

References

https://github.com/jorani/jorani/issues/426
issue-trackingtechnical-description
https://github.com/jorani/jorani/blob/v1.0.2/application/...
technical-description
https://github.com/jorani/jorani/commit/59c40322440182448...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212
leediay153 from Viettel Post
.