CVE-2026-110100

Deferred Deferred - Pending Action

Jorani Missing Authorization in Contracts Import

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse get_headers() and fopen() for server-side request forgery against internal hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110100

EUVD

EUVD-2026-98933

Affected Vendors & Products

Vendor	Product	Version / Range
Jorani	Jorani	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Jorani before version 1.0.4 has a missing authorization flaw in the Contracts::import() function. This allows any logged-in user to import days off into any contract by providing a contract ID and a URL. The vulnerability can be exploited to overwrite non-working-day calendars and may enable server-side request forgery against internal hosts via get_headers() and fopen().

Detection Guidance

Check Jorani logs for POST requests to /Contracts/import with arbitrary URLs or unusual contract IDs. Monitor for unauthorized changes to non-working-day calendars or internal SSRF attempts via get_headers() and fopen().

Impact Analysis

An attacker could manipulate work schedules by importing unauthorized days off into contracts, disrupting operations. They might also access internal systems by abusing the SSRF vulnerability to send requests to internal hosts, potentially stealing data or launching further attacks.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance failures may result in legal penalties or reputational damage.

Mitigation Strategies

Upgrade Jorani to version 1.0.4 or later. Restrict access to the Contracts::import() endpoint and validate all user inputs. Implement network-level controls to block internal SSRF attempts from Jorani servers.

Hi! I’m here to help you understand CVE-2026-110100. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70