PT-2026-78839

CVE-2026-76760

Published

2026-08-19

Updated

2026-08-20

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions chenhg5 cc-connect versions prior to 1.4.2

Description Remote code injection is possible through the manipulation of the exec argument within the Authenticate() function located in the core/webhook.go file.

Recommendations Update to a version newer than 1.4.1. As a temporary workaround, restrict access to the Authenticate() function in the core/webhook.go file to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Summmm

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\'Injection\')

Related identifiers