What is the CVSS score of CVE-2026-50886?

CVE-2026-50886 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Firefly III are affected by CVE-2026-50886?

Project Firefly III v6.5.9 contains an unauthenticated server-side request forgery vulnerability (CVSS 9.1) that allows attackers to enumerate and probe internal network infrastructure without valid…

How to fix or mitigate CVE-2026-50886?

24 hours: Identify all Project Firefly III v6.5.9 instances in production environment; implement firewall rules to restrict POST requests to webhook management endpoints from untrusted networks; enable detailed logging on webhook component. 7 days: Deploy WAF rules blocking malicious webhook payloads; audit internal services for exposed authentication mechanisms; review access logs for exploitation indicators. 30 days: Evaluate migration to alternative solution or await vendor patch; implement network segmentation isolating Firefly III from sensitive internal services; require API authentication on all internal service endpoints.

Firefly III CVE-2026-50886

EUVD-2026-36784 CRITICAL

Improper Access Control (CWE-284)

2026-06-15 mitre

GHSA-9mmg-q95p-gp67

Authentication Bypass N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network SSRF for internal scanning per the description; confidentiality is limited (C:L) to internal reconnaissance data, with no integrity or availability impact demonstrated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 15:35 vuln.today

CVSS changed

Jun 16, 2026 - 15:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request.

AnalysisAI

Server-Side Request Forgery in Project Firefly III v6.5.9 allows remote attackers to scan internal network resources by abusing improper access controls in the webhook management component via crafted POST requests. SSVC indicates a proof-of-concept exists and exploitation is automatable with total technical impact, though EPSS remains low (0.15%) and no public exploit identified at time of analysis beyond a referenced gist. The flaw is unauthenticated per the CVSS vector (PR:N) and provides a pivot point into otherwise unreachable internal services.

Technical ContextAI

Firefly III is a self-hosted personal finance manager written in PHP/Laravel that supports outbound webhooks for event notifications. The vulnerability falls under CWE-284 (Improper Access Control) in the webhook management endpoint, where the application accepts attacker-controlled URLs in a POST request without validating the target host or restricting requests to external destinations. Because the application server itself issues the resulting HTTP request, an attacker can coerce it into probing RFC1918 ranges, link-local metadata services (e.g., 169.254.169.254), and loopback-bound admin interfaces - the classic SSRF pattern enabled by missing destination allowlists.

RemediationAI

No vendor-released patch identified at time of analysis; defenders should monitor the Firefly III GitHub releases page and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-50886) for a fixed version superseding 6.5.9. As compensating controls, place Firefly III behind a reverse proxy or egress firewall that denies outbound traffic from the application to RFC1918, loopback, and cloud metadata addresses (169.254.169.254, fd00:ec2::254) - this neutralizes the SSRF impact but breaks legitimate webhooks targeting internal endpoints. Alternatively, restrict authenticated access to the webhook management routes via web-server-level authentication or IP allowlists, accepting the trade-off that any legitimate user account can still trigger the issue if access controls inside the app are themselves broken. Disabling the webhook feature entirely (if unused) is the lowest-risk mitigation.