CVE-2026-76760: chenhg5 cc-connect webhook.go authenticate code injection
A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. The reported GitHub issue was closed automatically due to inactivity.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
chenhg5 cc-connect versions up to and including 1.4.1 are affected. The vulnerable code is the Authenticate function in core/webhook.go.
Can this be exploited remotely without credentials?
The vulnerability is remotely exploitable and the vector indicates no privileges or user interaction are required. Exploitation involves manipulating the exec argument passed to Authenticate.
How urgent is remediation?
The issue is rated high with a 7.3 severity score, and public exploit information is available. The reported GitHub issue was automatically closed because of inactivity, so organizations should not rely on that issue for a remediation status.