CVE-2026-31974

CVE-2026-31974 is a Server-Side Request Forgery (SSRF) vulnerability affecting OpenProject versions prior to 17.2.0. An authenticated attacker can exploit the SMTP test endpoint or webhook functionality by providing arbitrary host and port values. This allows them to scan internal networks and identify reachable services based on observable response differences. Rated Medium (CVSS 4.3), the vulnerability has low attack complexity and requires low privileges, primarily impacting confidentiality by enabling internal network mapping. There is currently no evidence of active exploitation, nor are public exploit codes or significant community discussion available.