UTMStack versions prior to 11.2.16 contain a server‑side request forgery flaw in IdentityProviderService.validateMetadataUrl(). The flaw allows an authenticated attacker to supply an arbitrary metadata URL to the /api/identity‑providers endpoint. No host, IP, or scheme validation is performed, so the server acts on the request and can contact any internal or cloud metadata host. This can lead to internal network port scanning and retrieval of cloud instance‑metadata information, potentially exposing sensitive data or enabling further lateral movement.

The affected product is UTMStack with all releases before 11.2.16. Versions 11.2.15 and earlier are vulnerable. Updating to 11.2.16 or higher removes the flaw.

The CVSS score of 5.3 indicates a moderate severity vulnerability. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The vulnerability requires the attacker to be authenticated to the UTMStack API and to exploit the POST/PUT /api/identity‑providers endpoint. Once authenticated, the attacker can trigger the server to reach arbitrary internal or cloud addresses, which can be used for data exfiltration or further network reconnaissance.