MEDIUMVulnerability

CVE-2026-71250

Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user (with webhooks enabled, which is off by default) to configure a webhook targeting loopback services on the server.

Properties

severity
MEDIUM
score
4.3
cve_id
CVE-2026-71250
vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
published_at
2026-08-05T11:16:28.110
last_modified
2026-08-26T17:13:24.800

Related Entities (2)

HAS_WEAKNESS (1)

[Weakness]Server-Side Request Forgery (SSRF)

DESCRIBED_BY (1)

[Source]NVD

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-71250 — Ninja Signal Threat Intelligence | Ninja Signal