CVE-2026-50886: Project Firefly III has incorrect access control in the webhook management component

June 15, 2026 (updated August 27, 2026)

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

References

gist.github.com/pyuysig/f5395f90753ba652835ba9c6abf4c4ae
github.com/advisories/GHSA-9mmg-q95p-gp67
nvd.nist.gov/vuln/detail/CVE-2026-50886

Code Behaviors & Features

Detect and mitigate CVE-2026-50886 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →