This vulnerability is classified as CWE-918 (Server-Side Request Forgery) in JetEngine by Crocoblock (Jetimpex Inc.). It affects versions up to 3.8.11 and allows an attacker with low privileges and no user interaction to cause the server to perform unauthorized requests. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality and integrity with no impact on availability. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

An attacker with low privileges can exploit this SSRF vulnerability to cause the server to make unintended requests, potentially accessing or manipulating internal resources. The impact is limited to partial loss of confidentiality and integrity, with no availability impact reported. This could lead to information disclosure or unauthorized actions within the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected JetEngine versions and monitor for unusual server request activity related to SSRF. Avoid exposing the vulnerable functionality to untrusted users.