CVE-2026-50886: Incorrect access control in the webhook management component of Project Firefly III v6

Synopsis

Incorrect access control in the webhook management component of Firefly III v6.5.9 allows a remote, unauthenticated attacker to send a crafted POST request that causes the server to make outbound HTTP calls to attacker-specified internal addresses. This is a server-side request forgery (SSRF) class of bug, reachable over the network with no credentials required and no victim interaction needed. Successful exploitation lets an attacker map and probe internal network resources and services that would otherwise be unreachable from the outside. HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable webhook endpoint is exposed over the network, so the attacker must be able to reach the Firefly III service via HTTP/HTTPS.

• AuthenticationNot required

  The CVSS vector specifies PR:N, meaning no account or credential of any kind is needed to send the malicious POST request.

• Victim interactionNot required

  The CVSS vector specifies UI:N, meaning the attacker can trigger the vulnerability entirely on their own without any action from a user or administrator.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free, requiring no race conditions, specific memory layouts, or environmental prerequisites.

Blast Radius

• Attacker causes the Firefly III server to issue outbound HTTP requests to internal IP addresses and hostnames, effectively using it as a proxy to scan the internal network.
• Internal services such as metadata endpoints, databases, or cluster management APIs that are not exposed externally can be reached and fingerprinted through the vulnerable host.
• Response data or timing differences from internal hosts may be observable to the attacker, leaking information about topology, running services, and software versions.
• CVSS C:H and I:H ratings indicate full compromise of confidentiality and integrity of data the server can reach internally, though availability of the affected service itself is not directly impacted (A:N).