Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: Upon further research, the maintainer determined that the behavior described by the CVE record is intended behavior. Per the GitHub Security Advisory: "Libredesk is a single-tenant, self-hosted application. Configuring outbound webhook URLs requires an admin-only permission that is not granted by default - the operator must explicitly assign it. Anyone holding this permission already has full administrative control over the application, and outbound HTTP to operator-chosen URLs is the documented purpose of the webhook feature. This is working as designed." Notes: none.
CVSS
No CVSS.
References
No reference.
Configurations
No configuration.
History
No history.
Information
Published : 2026-02-20 00:16
Updated : 2026-06-09 14:16
NVD link : CVE-2026-26957
Mitre link : CVE-2026-26957
CVE.ORG link : CVE-2026-26957
JSON object : View
Products Affected
No product.
CWE
No CWE.