CVE-2026-32553 is a Server-Side Request Forgery (SSRF) vulnerability classified under CWE-918 in Brainstorm Force OttoKit versions <= 1.1.35. The vulnerability is exploitable without authentication and has a CVSS 3.1 base score of 7.2, indicating high severity. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) shows that the attack can be performed remotely with low complexity, no privileges, and no user interaction, affecting confidentiality and integrity with a scope change. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

An unauthenticated attacker can exploit this SSRF vulnerability to make the vulnerable server perform arbitrary requests. This can lead to partial confidentiality and integrity impacts, such as unauthorized information disclosure or manipulation of data accessible by the server. There is no indication of availability impact. The vulnerability affects the security posture of the affected OttoKit installations by allowing attackers to pivot or gather sensitive internal information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing network-level restrictions to limit outgoing requests from the affected service and monitor for unusual request patterns. Avoid exposing the vulnerable service to untrusted networks if possible.