CVE-2026-50886: Project Firefly III SSRF in webhook management component

CVE-2026-50886 · Severity: critical · CVSS 9.1 · Published 2026-06-15

Project Firefly III is a personal finance and budgeting application. An incorrect access control flaw in its webhook management component allows low-privileged users to create and trigger webhooks that perform server-side requests to internal services, potentially exposing sensitive internal infrastructure and enabling attacks on backend systems. This vulnerability requires user authentication but does not require administrative privileges.

Technologies: grumpydictator/firefly-iii (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-50886 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50886 being exploited in the wild.
How severe is CVE-2026-50886?
Critical severity, with a CVSS score of 9.1, published 15 June 2026.
Which products and versions are affected?
Firefly III <= 6.5.9, 6.5.9; grumpydictator/firefly-iii (Packagist) <= 6.5.9, ECOSYSTEM:introduced=0,last_affected=6.5.9.
Is there a fix for CVE-2026-50886?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50886 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-50886?
Check whether you run Firefly III or grumpydictator/firefly-iii (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper access control flaw (CWE-284) in Project Firefly III's webhook API endpoints. The create, update, and trigger webhook endpoints lack enforcement of the dedicated webhook management role, allowing any authenticated user to create webhooks. The webhook URL validator explicitly accepts loopback addresses (127.0.0.0/8), and the StandardWebhookSender component performs server-side Guzzle POST requests to stored URLs. A low-privileged authenticated user can create a webhook pointing to http://127.0.0.1:port or other internal services, then trigger it via POST /api/v1/webhooks/{id}/trigger-transaction/{transactionGroup}, causing the server to send requests from its own network context. This results in authenticated Server-Side Request Forgery (SSRF) that can probe or interact with localhost and other internal HTTP services reachable by the Firefly III host. No patch is currently available; patched versions have not been released.

Affected products

  • Project Firefly III Firefly III <= 6.5.9

Identifiers

  • CVE-2026-50886
  • GHSA-9mmg-q95p-gp67

Timeline

  • 2026-06-15: disclosed: Advisory published
  • 2026-08-27: advisory: GitHub Security Advisory reviewed and confirmed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.