Open-source package vulnerability · Composer (PHP)
CVE-2026-50886: Project Firefly III has incorrect access control in the webhook management component
criticalCVSS 3.1 9.1GHSA-9mmg-q95p-gp67
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
Published Jun 15, 2026 · Updated Aug 27, 2026
Affected packages
grumpydictator/firefly-iii
- Ecosystem
- Composer (PHP)
- Affected
- <= 6.5.9
- Fixed in
- No patched version yet
- Check
composer show grumpydictator/firefly-iii
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology