Project Firefly III has incorrect access control in the webhook management component

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2026-50886 · ADVISORY
• gist.github.com/pyuysig/f5395f90753ba652835ba9c6abf4c4ae · WEB
• firefly-iii/firefly-iii · PACKAGE

Lỗ hổng khác của grumpydictator/firefly-iii

• GHSA-6jq6-x4cx-qvcmTRUNG BÌNHFirefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)
• GHSA-5q8v-j673-m5v4TRUNG BÌNHFirefly III user API endpoints expose all users' information to any authenticated user (IDOR)
• CVE-2024-37893TRUNG BÌNH 5.9Firefly III is a free and open source personal finance manager. In affected versions an MFA bypass in the Firefly III OAuth flow may allow m…
• GHSA-29w6-c52g-m8jcTRUNG BÌNH 4.0C5 Firefly III CSV Injection.
• CVE-2024-22075TRUNG BÌNH 6.1Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.