Libredesk is a self-hosted customer support desk application. Versions prior to 1.0.2-0.20260215211005-727213631ce6 fail to validate destination URLs for webhooks, allowing an attacker posing as an authenticated "Application Admin" to force the server to make HTTP requests to arbitrary internal destinations. This could compromise the underlying cloud infrastructure or internal corporate network where the service is hosted. This issue has been fixed in version 1.0.2-0.20260215211005-727213631ce6.
This CVE has been withdrawn by MITRE
MITRE marked CVE-2026-26957 as REJECTED on . It is no longer considered a valid vulnerability record. The original content below is preserved for historical reference only.
Reason given by MITRE
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: Upon further research, the maintainer determined that the behavior described by the CVE record is intended behavior. Per the GitHub Security Advisory: "Libredesk is a single-tenant, self-hosted application. Configuring outbound webhook URLs requires an admin-only permission that is not granted by default - the operator must explicitly assign it. Anyone holding this permission already has full administrative control over th…
CVE-2026-26957
✕ Withdrawn — historical dataMEDIUMPre-NVD 6.9
6.9CVSS
- CVSS v3
- 6.9
- EchelonGraph score
- Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
- EPSS PROB
- —
- EPSS %ILE
- —
- KEV
- —Not applicable: this CVE ID was withdrawn
Published
February 20, 2026
Last Modified
April 15, 2026
References (2)
- security-advisories@githubhttps://github.com/abhinavxd/libredesk/commit/727213631ce6a36bcb06f50ce542155e78f51316
- security-advisories@githubhttps://github.com/abhinavxd/libredesk/security/advisories/GHSA-wgm6-9rvv-3438
Frequently asked(4)
What is CVE-2026-26957?
CVE-2026-26957 is a rejected CVE ID: its record was withdrawn on June 9, 2026 and no longer describes a vulnerability. Reason given: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: Upon further research, the maintainer determined that the behavior described by the CVE record is intended behavior. Per the GitHub Security Advisory: "Libredesk is a single-tenant, self-hosted application. Configuring outbound webhook URLs requires an admin-only permission that is not granted by default - the operator must explicitly assign it. Anyone holding this permission already has full administrative control over th…
When was the CVE record for CVE-2026-26957 published?
The CVE record for CVE-2026-26957 was published on February 20, 2026. EchelonGraph's copy of the record carries a last-modified date of April 15, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-26957?
CVE-2026-26957 has a CVSS v4.0 base score of 6.9 (the CNA's CVSS v4.0; NVD's own analysis pending).
How do I remediate CVE-2026-26957?
There is nothing to remediate under CVE-2026-26957: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.