Jorani versions prior to 1.0.4 allow any authenticated user to call a contract import function with a supplied contract ID and URL. This missing authorization lets the attacker overwrite non-working-day calendars for any contract and use PHP’s get_headers and fopen functions to request arbitrary internal URLs, enabling server‑side request forgery and potentially internal network discovery or data exfiltration. The weakness corresponds to CWE‑862, Missing Authorization.

The vulnerability exists in the Jorani web application for all releases before 1.0.4. Authenticated users with any valid session against the application can trigger the exploit, regardless of the operating system on which Jorani is running.

The CVSS score of 5.3 indicates a medium risk. No EPSS value is currently available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not widely exploited yet. Attackers would need to be authenticated to Jorani, but once logged in, they can craft a POST request to the import endpoint, supply any contract ID, and provide a URL to trigger the SSRF. The ability to contact internal hosts may lead to further exploitation if internal services respond in a meaningful way. Overall, the exploitability is high for authenticated users, but the damage is limited to calendar data and SSRF reach unless further internal vulnerabilities are present.