CVE-2026-32812 Details
Description
Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and local file reads. The SSO Metadata fetch endpoint at modules/sso/fetch_metadata.php accepts an arbitrary URL via $_GET['url'], validates it only with PHP's FILTER_VALIDATE_URL, and passes it directly to file_get_contents(). FILTER_VALIDATE_URL accepts file://, http://, ftp://, data://, and php:// scheme URIs. An authenticated administrator can use this endpoint to read arbitrary local files via the file:// wrapper (Local File Read), reach internal services via http:// (SSRF), or fetch cloud instance metadata. The full response body is returned verbatim to the caller. This issue has been fixed in version 5.0.7.
A vulnerability in Admidio versions 5.0.0 through 5.0.6 allows authenticated administrators to exploit the SSO Metadata API. The fetch_metadata.php endpoint accepts arbitrary URLs via a GET parameter, validates them with PHP's FILTER_VALIDATE_URL, and directly retrieves their contents using file_get_contents(). This validation is insufficient, as it permits various URI schemes, including file://, http://, ftp://, data://, and php://. Exploitation of this vulnerability can lead to Server-Side Request Forgery (SSRF) attacks, access to internal services, or unauthorized reading of local files through the file:// protocol. The fetched data is returned verbatim to the requester.
Users are advised to update to Admidio version 5.0.7, which restricts the URL fetch to HTTPS schemes, validates URLs more securely, and uses cURL for fetching metadata with added protections.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Admidio/admidio/security/advisories/GHSA-6j68-gcc3-mq73 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/Admidio/admidio/commit/f6b7a966abe4d75e9f707d665d7b4b5570e3185a | [email protected] | Patch |
| https://github.com/Admidio/admidio/releases/tag/v5.0.7 | [email protected] | ProductRelease Notes |
| https://github.com/Admidio/admidio/security/advisories/GHSA-6j68-gcc3-mq73 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| admidio admidio | >= 5.0.0, < 5.0.7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | New CVE Received | [email protected] |