CVE-2026-76760
chenhg5 cc-connect webhook.go authenticate code injection
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 19, 2026
- Updated
- Aug 20, 2026
- Reserved
- Aug 19, 2026
Description
A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. The reported GitHub issue was closed automatically due to inactivity.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
cc-connectchenhg5 |
|
References
- VDB-393229 | chenhg5 cc-connect webhook.go authenticate code injectionvdb-entrytechnical-description
- VDB-393229 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-76760 | CVE Analysis and Reportthird-party-advisory
- Submit #878916 | chenhg5 cc-connect v1.4.1 RCEthird-party-advisory
- https://github.com/chenhg5/cc-connect/issues/1488exploitissue-tracking
- https://github.com/chenhg5/cc-connect/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.