GitHub Advisoryadvisory · Packagist

GHSA-9mmg-q95p-gp67 Project Firefly III has incorrect access control in the webhook management component

CRITICAL Published 2026-06-15 Modified 2026-08-27 Official page ↗
Aliases
CVE-2026-50886
Ecosystem
Packagist
Packages
grumpydictator/firefly-iii
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-284
Reviewed
2026-08-27

Affected packages

• Packagist grumpydictator/firefly-iii: <= 6.5.9 (no fix yet)

Description

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

Related

Alias · CVE (1)

  • CVE-2026-50886 Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References