Project Firefly III has incorrect access control in the webhook management component

CRÍTICO 9.1CVE-2026-50886 · GHSA-9mmg-q95p-gp67 · Published 15/06/2026 · updated 17/06/2026

Em resumo

CVE-2026-50886 é uma vulnerabilidade CRÍTICO (CVSS 9.1) que afeta grumpydictator/firefly-iii.
Chance de exploração nos próximos 30 dias (EPSS): 0.31%, maior que 24.1% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
grumpydictator/firefly-iii Packagist	`≤ 6.5.9`	No fix yet

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

NVD description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

References

nvd.nist.gov/vuln/detail/CVE-2026-50886 · ADVISORY
gist.github.com/pyuysig/f5395f90753ba652835ba9c6abf4c4ae · WEB
firefly-iii/firefly-iii · PACKAGE

Mais vulnerabilidades de grumpydictator/firefly-iii

Ver tudo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

grumpydictator/firefly-iii

Packagist

≤ 6.5.9

No fix yet

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

NVD description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Mais vulnerabilidades de grumpydictator/firefly-iii

Ver tudo →