The flaw occurs in Apicurio Registry when the WSDLReaderAccessor creates a wsdl4j WSDLReader that still allows the javax.wsdl.importDocuments feature. With VALIDITY set to FULL, an attacker who can upload a WSDL document—by virtue of Developer‑role privileges—can embed attacker-controlled import URLs. The registry then issues HTTP requests to those URLs, giving the attacker access to arbitrary internal addresses. This behavior constitutes a classic SSRF, capable of internal network reconnaissance or data exfiltration, and is classified as CWE‑918.

The vulnerability affects the Red Hat build of Apicurio Registry version 3, as identified by the CPE cpe:/a:redhat:apicurio_registry:3. Any deployment that permits Developer‑role users to upload WSDL files with FULL validation enabled is vulnerable; no other vendors or product versions are noted.

The CVSS score of 7.4 signifies a moderate‑high severity with high exploitation difficulty. EPSS data is not available, and the issue is not listed in CISA KE exploitation reports yet. Exploitation requires that the attacker already has Developer‑role access, after which the SSRF can target internal services over HTTP or HTTPS. Consequently, the risk is significant for environments where internal services are exposed and Developer permissions are distributed broadly.