Project Firefly III has incorrect access control in the webhook management component

CRITICO 9.1CVE-2026-50886 · GHSA-9mmg-q95p-gp67 · Published 15/06/2026 · updated 17/06/2026

In breve

CVE-2026-50886 è una vulnerabilità CRITICO (CVSS 9.1) che riguarda grumpydictator/firefly-iii.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.31%, superiore al 24.1% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
grumpydictator/firefly-iii Packagist	`≤ 6.5.9`	No fix yet

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

NVD description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

References

nvd.nist.gov/vuln/detail/CVE-2026-50886 · ADVISORY
gist.github.com/pyuysig/f5395f90753ba652835ba9c6abf4c4ae · WEB
firefly-iii/firefly-iii · PACKAGE

Altre vulnerabilità di grumpydictator/firefly-iii

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

grumpydictator/firefly-iii

Packagist

≤ 6.5.9

No fix yet

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

NVD description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Altre vulnerabilità di grumpydictator/firefly-iii

Vedi tutto →