CVE-2026-26957
Description
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: Upon further research, the maintainer determined that the behavior described by the CVE record is intended behavior. Per the GitHub Security Advisory: "Libredesk is a single-tenant, self-hosted application. Configuring outbound webhook URLs requires an admin-only permission that is not granted by default - the operator must explicitly assign it. Anyone holding this permission already has full administrative control over the application, and outbound HTTP to operator-chosen URLs is the documented purpose of the webhook feature. This is working as designed." Notes: none.
How to fix
- github.com/abhinavxd/libredesk1.0.2-0.20260215211005-727213631ce6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/abhinavxd/libredeskGo | v < 1.0.2-0.20260215211005-727213631ce6 | 1.0.2-0.20260215211005-727213631ce6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.