Project Firefly III has incorrect access control in the webhook management component

严重 9.1CVE-2026-50886 · GHSA-9mmg-q95p-gp67 · Published 15/06/2026 · updated 17/06/2026

要点

CVE-2026-50886 是影响 grumpydictator/firefly-iii 的严重 (CVSS 9.1)漏洞。
未来 30 天内被利用的概率（EPSS）：0.31%，高于 24.1% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
grumpydictator/firefly-iii Packagist	`≤ 6.5.9`	No fix yet

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

NVD description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

References

nvd.nist.gov/vuln/detail/CVE-2026-50886 · ADVISORY
gist.github.com/pyuysig/f5395f90753ba652835ba9c6abf4c4ae · WEB
firefly-iii/firefly-iii · PACKAGE

grumpydictator/firefly-iii 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

grumpydictator/firefly-iii

Packagist

≤ 6.5.9

No fix yet

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

NVD description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

grumpydictator/firefly-iii 的其他漏洞

查看全部 →