The vulnerability is an unrestricted URL fetch in the SSO Metadata API. It accepts an arbitrary URL via the GET parameter and forwards it directly to file_get_contents after only a basic FILTER_VALIDATE_URL check, which permits file://, http://, ftp://, data://, and php:// scheme URIs. As a result, an attacker can trigger Server‑Side Request Forgery to reach internal services and can read arbitrary local files, including cloud instance metadata. The weakness is identified as CWE‑918.

Admidio user management solution versions 5.0.0 through 5.0.6 are affected. The fix was applied in version 5.0.7. Only authenticated administrators have access to the vulnerable endpoint.

The CVSS score of 6.8 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. However, exploitation requires administrative credentials, which limits the attack surface. If a privileged user is compromised, the attacker could read sensitive data or access internal services via SSRF. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at this time.