Firefly III v6.5.9 Access Control Issue: Early Warning
- Severity
- HIGH
- Affected component
- firefly-iii (packagist)
- Affected versions
- <= 6.5.9
- Patched version
- Not yet available
An early warning has been issued for an access control issue in Firefly III v6.5.9 that could allow unauthorized scanning of internal resources.
What happened
An early warning has been issued regarding a critical vulnerability in Firefly III v6.5.9. The vulnerability, tracked as CVE-2026-50886, involves incorrect access control in the webhook management component. This flaw reportedly allows attackers to scan internal resources via a crafted POST request. The issue has been flagged on June 15, 2026, and is under investigation. It is not yet confirmed if this vulnerability has been exploited in the wild.
The vulnerability affects versions of Firefly III up to and including 6.5.9. Users of this software are advised to review their webhook configurations for any signs of unauthorized access and to consider upgrading to the latest available version as a precautionary measure.
What to do about it
- Upgrade to the latest version of firefly-iii to mitigate potential risks.
- Review and audit webhook configurations for any unauthorized access or suspicious activity.
- Monitor the primary sources for updates on the vulnerability and any official fixes.
- Implement additional security measures to protect internal resources from unauthorized access.
How 0Day would have caught this
firefly-iii is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using firefly-iii version 6.5.9 or earlier, you may be affected by this vulnerability.
What should I do right now?
Upgrade to the latest version of firefly-iii and review your webhook configurations for any unauthorized access.
Has an official fix been released?
No official fix has been published yet. Monitor the sources for updates.