CVE-2026-56823

Name of the Vulnerable Software and Affected Versions AutoGPT (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) exists in the POST /api/integrations/webhooks/{webhook id}/ping endpoint. The system retrieves the target webhook using only the primary key without verifying ownership by the authenticated user. This allows an authenticated user to provide an arbitrary webhook id to confirm if a webhook exists, leak the OAuth provider type, and potentially trigger a ping delivery on behalf of another user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.