Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint (POST /admin/settings/mail_notifications) accepts arbitrary host and port values and exhibits measurable differences in response behaviour depending on whether the target IP exists and whether the port is open. An attacker with access can use these timing and error distinctions to map internal hosts and identify which services/ports are reachable. Similarly, you can create webhooks in OpenProject and point them to arbitrary IPs, resulting in the same kind of SSRF issue which allows attackers to scan the internal network. This vulnerability is fixed in 17.2.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-11 | 2 | Disclosure2 |
| 2026-03-19 | 1 | Patch1 |
A new CVE has been assigned for a vulnerability I reported: CVE-2026-31974 @yeswehack https://github.com/opf/openproject/security/advisories/GHSA-9wr7-j98g-2jh3 #bugbounty #openproject
Post summary
The user announces that CVE‑2026‑31974 has been assigned and includes a link to the GitHub OpenProject advisory, but provides no further technical or exploit details.
Found an SSRF in @openproject. SMTP test endpoint accepts arbitrary host/port and leaks whether internal IPs/ports are reachable through timing and error differences. Webhooks do the same thing. Fixed in 17.2.0. CVE-2026-31974 https://github.com/opf/openproject/security/advisories/GHSA-9wr7-j98g-2jh3
Post summary
The text reports an SSRF vulnerability in OpenProject's SMTP test endpoint and webhooks, detailing how it leaks internal IP reachability, and notes it was fixed in version 17.2.0 with a link to the advisory.
CVE-2026-31974 OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint (POST /admin/settings/mail_notifications) accept… https://www.cve.org/CVERecord?id=CVE-2026-31974
Post summary
The text announces CVE‑2026‑31974 affecting OpenProject’s SMTP test endpoint and notes that the issue was resolved in version 17.2.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | openproject | openproject | - | - | - |