CVE-2026-26957

Low risk· EPSS 19%

Published: 20/02/2026(UTC)Updated: 09/06/2026(UTC)Translated: 10/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.06%

19th percentile - higher than 19% of all known CVEs

Summary

CVE-2026-26957 has been rejected as the behavior described in the CVE record is intended. The Libredesk application is a single-tenant application, and configuring webhook URLs requires admin-only permissions that are not granted by default.

Risk Assessment

There is no risk to the organization as the webhook functionality operates as intended, and only users with the appropriate permissions have access to it.

Recommendation

It is recommended that administrators ensure that permissions for configuring webhooks are granted only to trusted users.

Other vulnerabilities in Libredesk

CVE-2025-68927Medium
LibreDesk prior to version 0.8.6-beta is vulnerable to stored HTML injection in the contact notes feature. An attacker can inject arbitrary HTML elements such as forms and images, which are stored and rendered without proper sanitization.

Original NVD description (English source)

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: Upon further research, the maintainer determined that the behavior described by the CVE record is intended behavior. Per the GitHub Security Advisory: "Libredesk is a single-tenant, self-hosted application. Configuring outbound webhook URLs requires an admin-only permission that is not granted by default - the operator must explicitly assign it. Anyone holding this permission already has full administrative control over the application, and outbound HTTP to operator-chosen URLs is the documented purpose of the webhook feature. This is working as designed." Notes: none.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS