The hcengineering platform before commit 68cbf8a contains an authenticated SSRF vulnerability in the /import endpoint of the front pod. Authenticated users can exploit this by providing crafted URLs that cause the server to make arbitrary requests to internal services. This can lead to unauthorized data access, exfiltration of responses, and replaying credentials against backend systems. The vulnerability affects versions up to 0.7.423. No vendor advisory or patch information is currently available, and the vulnerability is not known to be exploited in the wild.

Authenticated attackers can leverage this SSRF vulnerability to make arbitrary requests from the server to internal services, potentially exposing sensitive internal resources and data. They may also exfiltrate response data and replay credentials against backend systems, increasing the risk of further compromise. The impact is limited by the requirement for authenticated access and the medium CVSS score reflects this.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /import endpoint to trusted users only and monitor for suspicious activity related to server-side requests. Avoid exposing internal services that could be targeted via SSRF.