A server‑side request forgery (SSRF) flaw in the API Checker extension allows attackers to send arbitrary requests from the FMS server, giving them the ability to access internal services and execute privileged API calls. The vulnerability is identified as CWE‑918 and can enable an attacker to bypass normal access controls, effectively elevating privileges within the system.

Pandora FMS products from version 777 through 800 are impacted. The vendor notes that the issue is fixed in later releases 802 and 800.2.

The CVSS score of 7.1 indicates a high‑impact flaw. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that no widespread exploitation is currently documented. Attackers would need the ability to interact with the vulnerable API Checker, and the internal network must be reachable from the API, meaning adequate network segmentation can reduce risk. However, exploitation remains feasible without advanced prerequisites, so the threat should be treated as a medium‑to‑high risk.