Unrestricted URL Fetch in Admidio Open Source User Management Solution

CVE-2026-32812

What is CVE-2026-32812?

The Admidio user management solution includes a vulnerability in versions 5.0.0 to 5.0.6 that permits unrestricted URL fetching via the SSO Metadata API. The affected endpoint allows an authenticated administrator to manipulate requests by passing arbitrary URLs through a poorly validated input process. The lack of rigorous validation means that malicious users can exploit this to perform Server-Side Request Forgery (SSRF) or gain unauthorized access to sensitive local files. This poses significant risks as it can expose confidential data or internal services. The issue has been resolved in version 5.0.7.

References