CVE-2026-56823: AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the POST /api/integrations/webhooks/{webhookid}/ping endpoint fetches the target webhook by primary key alone without verifying that the webhook belongs to the authenticated user. Any authenticated user can supply an arbitrary webhookid to confirm webhook existence, leak the webhook's OAuth provider type, and in some cases trigger a ping delivery on behalf of another user. This vulnerability is fixed in .
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56823?
The severity of CVE-2026-56823 is medium with a score of 5.4.
How do I fix CVE-2026-56823?
To fix CVE-2026-56823, ensure proper authorization checks are implemented for the POST /api/integrations/webhooks/{webhook_id}/ping endpoint.
What type of vulnerability is CVE-2026-56823?
CVE-2026-56823 is an Insecure Direct Object Reference (IDOR) vulnerability.
What impact does CVE-2026-56823 have on users?
CVE-2026-56823 allows enumeration of webhooks and cross-user ping triggering, potentially leading to unauthorized actions.
Which software is affected by CVE-2026-56823?
CVE-2026-56823 affects the AutoGPT software platform.