CVE-2026-32812 Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint
An authenticated administrator can exploit an unrestricted URL fetch in the SSO Metadata endpoint to perform Server-Side Request Forgery and read arbitrary local files.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-32812?
CVE-2026-32812 is a medium-severity server-side request forgery vulnerability in admidio, published on 20 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and local file reads. The SSO Metadata fetch endpoint at modules/sso/fetch_metadata.php accepts an arbitrary URL via $_GET['url'], validates it only with PHP's FILTER_VALIDATE_URL, and passes it directly to file_get_contents(). FILTER_VALIDATE_URL accepts file://, http://, ftp://, data://, and php:// scheme URIs. An authenticated administrator can use this endpoint to read arbitrary local files via the file:// wrapper (Local File Read), reach internal services via http:// (SSRF), or fetch cloud instance metadata. The full response body is returned verbatim to the caller. This issue has been fixed in version 5.0.7.
Weakness: CWE-918
Which versions are affected by CVE-2026-32812?
2 open source packages ship an affected version, including admidio/admidio. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
admidio/admidio Packagist | From 5.0.0 | 5.0.7 |
admidio/admidio Packagist | From 5.0.0 | 5.0.7 |
Products include Admidio Admidio.
How do I fix CVE-2026-32812?
Upgrade admidio/admidio to 5.0.7 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-32812 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32812 exists.
Other vulnerabilities in admidio
- CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php
- CVE-2021-32630 Various
- CVE-2026-32817 Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
- CVE-2024-38529 Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment
- CVE-2026-32756 Admidio: Unrestricted File Upload via CSRF Token Validation Bypass in Documents & Files Module
Sources
Also known as GHSA-6j68-gcc3-mq73.