Executive brief
Project Firefly III is a personal finance and budgeting application. An incorrect access control flaw in its webhook management component allows low-privileged users to create and trigger webhooks that perform server-side requests to internal services, potentially exposing sensitive internal infrastructure and enabling attacks on backend systems. This vulnerability requires user authentication but does not require administrative privileges.
Technical details
The vulnerability is an improper access control flaw (CWE-284) in Project Firefly III's webhook API endpoints. The create, update, and trigger webhook endpoints lack enforcement of the dedicated webhook management role, allowing any authenticated user to create webhooks. The webhook URL validator explicitly accepts loopback addresses (127.0.0.0/8), and the StandardWebhookSender component performs server-side Guzzle POST requests to stored URLs. A low-privileged authenticated user can create a webhook pointing to http://127.0.0.1:port or other internal services, then trigger it via POST /api/v1/webhooks/{id}/trigger-transaction/{transactionGroup}, causing the server to send requests from its own network context. This results in authenticated Server-Side Request Forgery (SSRF) that can probe or interact with localhost and other internal HTTP services reachable by the Firefly III host. No patch is currently available; patched versions have not been released.
Affected products
- Project Firefly III Firefly III <= 6.5.9
Timeline
- 2026-06-15: disclosed: Advisory published
- 2026-08-27: advisory: GitHub Security Advisory reviewed and confirmed