Vulnerability · Published Mar 20, 2026 · Assigned by GitHub_M

CVE-2026-32812Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

Medium 6.8

In plain English

A medium-severity server-side request forgery in admidio from Admidio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 61.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and local file reads. The SSO Metadata fetch endpoint at modules/sso/fetch_metadata.php accepts an arbitrary URL via $_GET['url'], validates it only with PHP's FILTER_VALIDATE_URL, and passes it directly to file_get_contents(). FILTER_VALIDATE_URL accepts file://, http://, ftp://, data://, and php:// scheme URIs. An authenticated administrator can use this endpoint to read arbitrary local files via the file:// wrapper (Local File Read), reach internal services via http:// (SSRF), or fetch cloud instance metadata. The full response body is returned verbatim to the caller. This issue has been fixed in version 5.0.7.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	admidio/admidio	5.0.7	GHSA-6j68-gcc3-mq73

Affected products (as reported)

Vendor	Product	Versions
Admidio	admidio	>= 5.0.0, < 5.0.7

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/Admidio/admidio/security/advisories/GHSA-6j68-gcc3-mq73 x_refsource_CONFIRM
https://github.com/Admidio/admidio/commit/f6b7a966abe4d75e9f707d665d7b4b5570e3185a x_refsource_MISC
https://github.com/Admidio/admidio/releases/tag/v5.0.7 x_refsource_MISC