CVE-2026-54544 in Fireshare
Summary
by MITRE • 09/16/2026
Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.16, two API endpoints that trigger outbound HTTP requests are missing the @login_required decorator. An unauthenticated attacker can call POST /api/test-discord-webhook or POST /api/test-webhook and cause the Fireshare server to issue an arbitrary HTTP POST to any URL the attacker supplies, including internal network addresses and cloud metadata services. No credentials, session cookies, or prior access are required. Version 1.6.16 contains a patch.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
Fireshare is a self-hosted application designed for sharing media files and links within private networks or with specific users. The security architecture of such applications relies heavily on strict authentication controls to prevent unauthorized interactions with backend services. In versions prior to 1.6.16, the implementation of API endpoints responsible for testing webhook integrations contained critical access control failures. Specifically, the POST /api/test-discord-webhook and POST /api/test-webhook endpoints were exposed without requiring user authentication or session validation. This architectural flaw means that any entity capable of reaching the Fireshare server over the network can invoke these functions without providing credentials, cookies, or prior authorization tokens.
The technical nature of this vulnerability constitutes an Insecure Direct Object Reference combined with a Broken Access Control issue. By omitting the @login_required decorator, the application fails to verify the identity and privileges of the caller before executing sensitive operations. The core risk lies in the functionality itself: these endpoints accept arbitrary URLs as input parameters and subsequently initiate outbound HTTP POST requests from the server to those destinations. This capability transforms the vulnerable service into a potential Server-Side Request Forgery vector, allowing an attacker to dictate where the server sends data or performs network checks.
The operational impact of this flaw is significant due to the context in which Fireshare typically operates. Since these applications are often deployed within internal corporate networks or behind firewalls that trust local traffic, an unauthenticated attacker can exploit this endpoint to probe internal services that would otherwise be inaccessible from the public internet. This includes scanning for other vulnerable hosts on the LAN, accessing administrative interfaces of internal devices, or interacting with database ports and management consoles. Furthermore, if the server is deployed in a cloud environment, attackers can target cloud metadata services such as AWS Instance Metadata Service or Azure Managed Identity endpoints. Accessing these metadata APIs allows an attacker to retrieve temporary security credentials, IAM roles, and other sensitive configuration data, potentially leading to full compromise of the underlying infrastructure.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-918 Server-Side Request Forgery (SSRF). In terms of offensive tactics, it maps directly to ATT&CK technique T1557 Adversary-in-the-Middle or more specifically T1046 Network Service Discovery when used for internal scanning, and T1552.004 Unsecured Credentials if leveraged against cloud metadata services to steal access tokens. The lack of authentication makes it a high-severity issue as the attack complexity is minimal, requiring only network connectivity to the target port.
To mitigate this risk, organizations running Fireshare must immediately upgrade to version 1.6.16 or later, which includes the patch that enforces proper authentication on these endpoints. For deployments where an immediate update is not feasible, temporary mitigations include configuring a web application firewall or reverse proxy rules to block external access to the /api/test-webhook and /api/test-discord-webhook paths. Additionally, network segmentation strategies should be reviewed to ensure that even if such internal services are exposed, they cannot reach critical backend infrastructure or cloud metadata endpoints by default. Regular security audits of API endpoint decorators and input validation logic are recommended to prevent similar access control bypasses in the future.