CVE-2026-32812

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and local file reads. The SSO Metadata fetch endpoint at modules/sso/fetch_metadata.php accepts an arbitrary URL via $_GET['url'], validates it only with PHP's FILTER_VALIDATE_URL, and passes it directly to file_get_contents(). FILTER_VALIDATE_URL accepts file://, http://, ftp://, data://, and php:// scheme URIs. An authenticated administrator can use this endpoint to read arbitrary local files via the file:// wrapper (Local File Read), reach internal services via http:// (SSRF), or fetch cloud instance metadata. The full response body is returned verbatim to the caller. This issue has been fixed in version 5.0.7.

• CWE-918

• https://github.com/Admidio/admidio/commit/f6b7a966abe4d75e9f707d665d7b4b5570e3185aPatch
• https://github.com/Admidio/admidio/releases/tag/v5.0.7Product, Release Notes
• https://github.com/Admidio/admidio/security/advisories/GHSA-6j68-gcc3-mq73Exploit, Mitigation, Vendor Advisory
• https://github.com/Admidio/admidio/security/advisories/GHSA-6j68-gcc3-mq73Exploit, Mitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32806dataCycle is a data management system for centrally storing,…7.5
• CVE-2026-32807dataCycle is a data management system for centrally storing,…7.5
• CVE-2026-32808pyLoad is a free and open-source download manager written in…8.1
• CVE-2026-3281A vulnerability was detected in libvips 8.19.0. This affects…7.8
• CVE-2026-32810Halloy is an IRC application written in Rust. In versions on…5.5
• CVE-2026-32811Heimdall is a cloud native Identity Aware Proxy and Access C…7.5
• CVE-2026-32813Admidio is an open-source user management solution. Versions…8
• CVE-2026-32814libheif is a HEIF and AVIF file format decoder and encoder. …6.5
• CVE-2026-32815SiYuan is a personal knowledge management system. In version…7.5
• CVE-2026-32816Admidio is an open-source user management solution. In versi…5.7
• CVE-2026-32817Admidio is an open-source user management solution. In versi…9.1
• CVE-2026-32818Admidio is an open-source user management solution. In versi…6.5