The vulnerability exists in Kan versions 0.5.4 and earlier where the /api/download/attatchment endpoint accepts a user‑supplied URL parameter without authentication or validation. The server blindly passes this URL to fetch() and returns the response body, allowing an unauthenticated attacker to force the server to make HTTP requests to arbitrary destinations. This leads to Server‑Side Request Forgery (SSRF) and can expose internal services, cloud metadata endpoints, or private network resources, potentially leaking sensitive information or enabling further attacks.

This issue affects the open‑source project management tool Kan (product kan:kan) running versions 0.5.4 and earlier.

The vulnerability has a CVSS score of 8.6 indicating high severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. An attacker can exploit it by sending unauthenticated requests to the /api/download/attatchment endpoint, which forwards the supplied URL to the server. Until the affected versions are updated, the risk remains significant.