Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-32812: Admidio lets admin read files and reach internal services

CVE-2026-32812 · published 7 months ago

Summary

Versions 5.0.0 through 5.0.6 of the Admidio user‑management system let a logged‑in administrator supply any web address to a special API. The system then fetches that address without proper checks, which can be used to pull files from the server itself or contact internal network resources, exposing data. Updating to version 5.0.7 or later resolves the issue.

What to do

Update admidio admidio/admidio to version 5.0.7.
Update admidio admidio to version 5.0.7.

Affected software

Ecosystem	Vendor	Product	Affected versions
Packagist	admidio	admidio/admidio	>= 5.0.0, < 5.0.7 Fix: upgrade to 5.0.7
composer	admidio	admidio	>= 5.0.0, <= 5.0.6 Fix: upgrade to 5.0.7
–	admidio	admidio	>= 5.0.0, < 5.0.7 `cpe:2.3:a:admidio:admidio::::::::`

Original advisory text

Admidio Vulnerable to SSRF and Local File Read via Unrestricted URL Fetch in SSO Metadata Endpoint

Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, unrestricted URL fetch in the SSO Metadata API can result in SSRF and local file reads. The SSO Metadata fetch endpoint at modules/sso/fetch_metadata.php accepts an arbitrary URL via $_GET['url'], validates it only with PHP's FILTER_VALIDATE_URL, and passes it directly to file_get_contents(). FILTER_VALIDATE_URL accepts file://, http://, ftp://, data://, and php:// scheme URIs. An authenticated administrator can use this endpoint to read arbitrary local files via the file:// wrapper (Local File Read), reach internal services via http:// (SSRF), or fetch cloud instance metadata. The full response body is returned verbatim to the caller. This issue has been fixed in version 5.0.7.

References

https://github.com/Admidio/admidio/security/advisories/GHSA-6j68-gcc3-mq73 Vendor Advisory
https://github.com/advisories/GHSA-6j68-gcc3-mq73
https://github.com/Admidio/admidio/releases/tag/v5.0.7 URL
https://github.com/Admidio/admidio Product
https://github.com/Admidio/admidio/commit/f6b7a966abe4d75e9f707d665d7b4b5570e318... Patch
https://nvd.nist.gov/vuln/detail/CVE-2026-32812 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32812... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published20 Mar 2026

Updated21 Oct 2026

First seen16 Mar 2026

Sources

GHSA-6j68-gcc3-mq73 · GHSA

CVE-2026-32812 · OSV

Track software like this

Free during beta