CVE-2026-32553
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
OttoKit versions up to 1.1.35 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send requests from the server to internal resources.
Risk Assessment
An attacker can access internal services or data that are not publicly available, potentially leading to confidentiality breaches.
Recommendation
Upgrade OttoKit to the latest version that fixes this vulnerability.
Other vulnerabilities in OttoKit
See all- CVE-2026-49781Critical
There is an unauthenticated PHP Object Injection vulnerability in OttoKit versions <= 1.1.27.
- CVE-2026-39479High
The OttoKit suretriggers plugin by Brainstorm Force up to version 1.1.20 inclusive is vulnerable to Blind SQL Injection due to improper neutralization of special elements used in an SQL command.
Original NVD description (English source)
Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS