This vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to exploit insufficient validation on webhook URLs. Although the URL syntax is checked using FILTER_VALIDATE_URL, there is no IP or host denylist to prevent internal network addresses from being targeted. Consequently, an attacker can register a webhook pointing to internal hosts and cause the server to issue HTTP POST requests to these internal addresses when the webhook event triggers, leading to potential SSRF attacks.

The vulnerability allows an authenticated user with consumer-role privileges to cause the Fusio server to make HTTP requests to internal network resources. This can potentially expose internal services or data that are not otherwise accessible externally. The CVSS score of 6.5 (medium severity) reflects the moderate impact, with high confidentiality impact but no integrity or availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict consumer-role user permissions and monitor webhook registrations for suspicious URLs. Consider network-level controls to prevent the Fusio server from making unauthorized internal HTTP requests.