Incorrect Access Control in Firefly III Webhook Management

Executive Summary

CVE-2026-50886 is a vulnerability in Project Firefly III version 6.5.9 related to incorrect access control in the webhook management component.

Specifically, low-privileged authenticated API users can create and trigger webhooks without having the dedicated webhook management role because the API endpoints do not enforce proper role checks.

Additionally, the webhook URL validator accepts loopback addresses (such as 127.0.0.0/8), which allows an attacker to send server-side POST requests to localhost or other internal HTTP services accessible from the Firefly III server.

By creating a webhook with a loopback URL and triggering it, an attacker can perform authenticated Server-Side Request Forgery (SSRF) from the Firefly III server, enabling them to scan or interact with internal resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with low-level authenticated access to probe or interact with internal services that are normally not exposed externally.

Because the attacker can send server-side POST requests to internal resources via the webhook mechanism, they may be able to scan internal networks, access sensitive internal APIs, or exploit other internal services.

The actual impact depends on what internal services are reachable from the Firefly III server and what information or functionality those services expose.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized creation and triggering of webhooks by low-privileged authenticated users in Firefly III version 6.5.9. Specifically, look for webhook creation requests that include loopback addresses (127.0.0.0/8) in the webhook URL, which should normally be restricted.

Commands to help detect exploitation attempts could include inspecting web server logs or API request logs for POST requests to the webhook creation and update endpoints containing loopback IP addresses.

• Use grep or similar tools to search logs for webhook creation attempts with loopback URLs, e.g., `grep -E 'webhook.*127\.0\.0\.' /var/log/fireflyiii/api.log`.
• Monitor for unusual POST requests to internal services originating from the Firefly III server, which may indicate SSRF activity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the webhook management API endpoints to only trusted and properly authorized users, ensuring that only users with the dedicated webhook management role can create or update webhooks.

Additionally, implement validation to disallow webhook URLs that point to loopback addresses (127.0.0.0/8) or other internal IP ranges to prevent SSRF attacks.

If possible, upgrade Firefly III to a version where this vulnerability is fixed or apply any available patches.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Firefly III v6.5.9 allows authenticated users to perform Server-Side Request Forgery (SSRF) attacks, potentially exposing internal services. This unauthorized internal resource scanning and interaction could lead to unauthorized access or data exposure.

Such unauthorized access risks may impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and internal systems to protect privacy and confidentiality.

However, the exact effect on compliance depends on the nature of the internal services exposed and whether sensitive or regulated data could be accessed or compromised through this vulnerability.

Useful 0 Not Useful 0