Project Firefly III has incorrect access control in the webhook management component

CRÍTICO 9.1CVE-2026-50886 · GHSA-9mmg-q95p-gp67 · Published 15/06/2026 · updated 17/06/2026

En resumen

CVE-2026-50886 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a grumpydictator/firefly-iii.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.31%, mayor que el 24.1% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
grumpydictator/firefly-iii Packagist	`≤ 6.5.9`	No fix yet

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

NVD description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

References

nvd.nist.gov/vuln/detail/CVE-2026-50886 · ADVISORY
gist.github.com/pyuysig/f5395f90753ba652835ba9c6abf4c4ae · WEB
firefly-iii/firefly-iii · PACKAGE

Más vulnerabilidades de grumpydictator/firefly-iii

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

grumpydictator/firefly-iii

Packagist

≤ 6.5.9

No fix yet

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

NVD description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Más vulnerabilidades de grumpydictator/firefly-iii

Ver todo →