An authenticated consumer‑role user in Apioo Fusio 8.8.3 can register a webhook URL that points to an internal host. When the event that triggers the webhook fires, the server will send an HTTP POST to the attacker‑supplied internal URL, giving the attacker the ability to issue requests to internal network addresses. This SSRF flaw can allow access to services running inside the network and expose internal information, as the server does not enforce any denylist on the URL supplied.

Apioo Fusio version 8.8.3, affecting users with consumer‑role permissions who can register webhooks. The vulnerability resides in the webhook registration endpoint that only validates the URL syntax using FILTER_VALIDATE_URL and does not enforce any denylist for internal addresses.

The CVSS score of 6.5 indicates moderate severity. Because no EPSS score is available, the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with consumer‑role permissions who submits a crafted webhook URL; when the webhook fires the server will perform HTTP POST requests to the supplied internal address, potentially allowing the attacker to reach services on the internal network and obtain internal information.