GHSA-9mmg-q95p-gp67

Project Firefly III has incorrect access control in the webhook management component

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-50886

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	grumpydictator/firefly-iii	<= 6.5.9	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-50886 advisory
https://gist.github.com/pyuysig/f5395f90753ba652835ba9c6abf4c4ae web
https://github.com/firefly-iii/firefly-iii package