CVE-2026-54544 - Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints

Back Back to CVE browser

HIGH

Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints

Published Sep 15, 2026

7.2

HIGH

CVSS 3.1

EPSS 0.41%

Description

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @login_required decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare server to issue an arbitrary HTTP POST to any URL the attacker supplies, including internal network addresses and cloud metadata services. No credentials, session cookies, or prior access are required. Version 1.6.16 contains a patch.

Affected products

Vendor ShaneIsrael Product Fireshare Default
n/a
- Version
  < 1.6.16
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ShaneIsrael

Fireshare

n/a

Version	Status	Constraints
< 1.6.16	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-79948
Advisory
https://github.com/ShaneIsrael/fireshare/commit/3d786848d2d27344d4cdecf1bd0d54294c6ca160
x_refsource_MISC
https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-w7j7-gv7f-gj92
exploitx_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-79948		Advisory
https://github.com/ShaneIsrael/fireshare/commit/3d786848d2d27344d4cdecf1bd0d54294c6ca160		x_refsource_MISC
https://github.com/ShaneIsrael/fireshare/security/advisories/GHSA-w7j7-gv7f-gj92		exploitx_refsource_CONFIRM