UTMStack EUVD-2026-91792

Requires a valid authenticated UTMStack account (PR:L) able to reach the POST/PUT /api/identity-providers endpoint; the attacker supplies a crafted metadata URL and the vulnerable validateMetadataUrl() performs no validation of target host, IP, or scheme, so no special product configuration is needed beyond the identity-provider feature being reachable. Limiting factors: exploitation requires authentication (not anonymous), and real-world impact is amplified only when UTMStack runs in a cloud environment exposing an instance-metadata service (e.g., 169.254.169.254) or has reachable internal services; on isolated/on-prem deployments the SSRF is limited to internal network reconnaissance. Affected versions are all releases before 11.2.16.

This is a genuine but moderate-severity issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires PR:L - a valid authenticated account - which meaningfully shrinks the attacker pool to insiders or anyone who has already obtained credentials. The vendor rates vulnerable-system impact as none (VC:N/VI:N/VA:N) and only subsequent-system confidentiality as low (SC:L), reflecting that the SSRF itself leaks no UTMStack data directly but can reach other systems (internal services, cloud instance-metadata). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is: no public exploit identified at time of analysis. The realistic worst case is cloud metadata/credential theft (e.g., IMDSv1 role credentials) or internal port scanning, which is why SSRF to metadata endpoints is often more dangerous than a 5.3 suggests - but that elevated impact depends entirely on the deployment running in a cloud environment with an exposed metadata service. Net: a real priority for cloud-hosted UTMStack instances with lower-privilege operators, but lower urgency for on-prem/single-tenant deployments. NOTE: the SC:L rating arguably understates impact if IMDSv1 role credentials are retrievable; verify cloud exposure per deployment.

An authenticated low-privilege UTMStack user sends a POST or PUT to /api/identity-providers with a metadata URL pointing at an internal host or the cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/). Because validateMetadataUrl() does not validate host, IP, or scheme, the server issues the request on the attacker's behalf, enabling internal port scanning and potential retrieval of cloud instance credentials. No public exploit code is identified in the provided data; exploitation requires a valid authenticated session.