CVE-2026-26957
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER.
Does this matter?
Not yet scored. NVD analysis is pending; check back once CVSS and EPSS values are published.
Description
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: Upon further research, the maintainer determined that the behavior described by the CVE record is intended behavior. Per the GitHub Security Advisory: "Libredesk is a single-tenant, self-hosted application. Configuring outbound webhook URLs requires an admin-only permission that is not granted by default - the operator must explicitly assign it. Anyone holding this permission already has full administrative control over the application, and outbound HTTP to operator-chosen URLs is the documented purpose of the webhook feature. This is working as designed." Notes: none.
- CVSS
- Not yet scored
- EPSS
- No score yet
- CISA KEV
- Not listed
- Source
- security-advisories@github.com
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.