Squidex versions before 7.23.0 allow an authenticated user with low privileges, such as schema editors, to direct the server’s Jint HTTP client to make arbitrary outbound HTTP requests. The missing SSRF protection enables the attacker to reach internal or cloud metadata services, potentially exposing credentials and providing a foothold for lateral movement. This flaw is identified as CWE‑918 (Server‑Side Request Forgery).

The vulnerability affects the Squidex content management platform, specifically all releases earlier than 7.23.0. Users running those earlier versions are at risk if they continue to provide authenticated access with editing permissions.

The CVSS score of 7.3 indicates a high severity risk. EPSS data is not available, and the issue is not listed in CISA’s KEV catalogue, suggesting no publicly known exploits yet. However, the attack requires only a low‑privileged authenticated session and can be used to reach internal endpoints, so the real‑world risk remains significant, especially in environments with exposed internal services or cloud metadata access. The attack vector is likely external, mediated by legitimate API calls from a compromised or malicious user account.