CVE-2026-50886
Project Firefly III has incorrect access control in the webhook management component
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
- Record
CVE-2026-50886- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2026-36784
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
- Record
EUVD-2026-36784- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9mmg-q95p-gp67
Project Firefly III has incorrect access control in the webhook management component
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
- Record
GHSA-9mmg-q95p-gp67- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
- Record
CVE-2026-50886- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-9mmg-q95p-gp67
Project Firefly III has incorrect access control in the webhook management component
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.
- Record
GHSA-9mmg-q95p-gp67- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
grumpydictator/firefly-iiiPackagist |
through 6.5.9 | None known |
grumpydictator/firefly-iiiPackagist |
through 6.5.9, plus listed versions 3.0.03.0.13.0.23.0.33.1 Show 45 moreShow less3.1.13.1.23.1.33.1.43.1.53.1.63.103.10.13.10.23.10.33.10.43.2.03.2.13.2.23.2.33.2.43.2.53.33.3.13.3.23.3.33.3.43.3.53.3.63.3.73.3.83.3.93.43.4.0.13.4.0.103.4.0.23.4.0.33.4.0.43.4.0.53.4.0.63.4.0.73.4.0.83.4.0.93.4.13.4.103.4.113.4.23.4.33.4.43.4.4.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-50886 is a critical vulnerability (CVSS 9.1) in grumpydictator/firefly-iii, published June 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. No source names a fixed version.
References
Left out here: 359 versions. The JSON record has them.