OpenProject allows a user to send arbitrary HTTP requests through its SMTP test endpoint and webhook feature, creating blind SSRF opportunities. The system responds differently when a target IP address exists or a specified port is reachable, providing timing and error cues that an attacker can observe. By exploiting these observable differences, an attacker can map internal hosts and discover which services or ports are available inside the network, exposing sensitive internal topology information without directly reading data from services.

Versions of OpenProject before 17.2.0 are affected. The vulnerability surfaces in the SMTP test endpoint (POST /admin/settings/mail_notifications) and the webhook creation interface, enabling requests to arbitrary IP addresses and ports. All affected releases share the same flaw, as listed by the vendor. Upgrading to 17.2.0 or later removes the flaw.

The base severity score of 3.0 indicates low overall risk, and the estimated exploitation likelihood is below 1%, suggesting that widespread attacks are unlikely. The flaw does not appear in the federal catalog of known exploited vulnerabilities. The attack requires an attacker to have access to the OpenProject instance, either via authenticated user privileges or a compromised account, making the vector internal and limited to authorized users. Consequently, the risk is primarily to confidentiality of internal network topology rather than direct data theft or code execution.