CVE-2026-76760: medium-severity vulnerability in chenhg5 cc-connect
chenhg5 cc-connect webhook.go authenticate code injection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.5%
A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. The reported GitHub issue was closed automatically due to inactivity.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
chenhg5 · cc-connectpublic PoCs found — 1
cve_referencegithub.com/chenhg5/cc-connect/issues/1488unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — chenhg5 cc-connect
In the same product, most dangerous first.
CVE-2026-76761MEDIUMchenhg5 cc-connect Management API engine.go shellExecCommand os command injectionEPSS 2.1%CVE-2026-92801HIGHcc-connect through 1.5.0 User Allowlist Bypass via Feishu Card ActionsEPSS 0.5%CVE-2026-108549CRITICALcc-connect through 1.5.0 Missing Authentication via MAX Webhook Sender SpoofingEPSS 0.5%