Project Firefly III has incorrect access control in the webhook management component

KRITISCH 9.1CVE-2026-50886 · GHSA-9mmg-q95p-gp67 · Published 15/06/2026 · updated 17/06/2026

Kurz gesagt

CVE-2026-50886 ist eine Schwachstelle (KRITISCH (CVSS 9.1)) in grumpydictator/firefly-iii.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.31%, höher als bei 24.1% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
grumpydictator/firefly-iii Packagist	`≤ 6.5.9`	No fix yet

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

NVD description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

References

nvd.nist.gov/vuln/detail/CVE-2026-50886 · ADVISORY
gist.github.com/pyuysig/f5395f90753ba652835ba9c6abf4c4ae · WEB
firefly-iii/firefly-iii · PACKAGE

Weitere Schwachstellen in grumpydictator/firefly-iii

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

grumpydictator/firefly-iii

Packagist

≤ 6.5.9

No fix yet

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

NVD description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Weitere Schwachstellen in grumpydictator/firefly-iii

Alle anzeigen →