A vulnerability was found in chenhg5 cc-connect up to 1.4.1. (CVE-2026-76760)

CVE-2026-76760 is a code injection vulnerability in the Authenticate function of the core/webhook.go file in chenhg5 cc-connect versions up to 1.4.1. The vulnerability is triggered by manipulation of the exec argument, allowing remote attackers to inject code. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Public exploit code exists, but there is no information about active exploitation in the wild. No patch or official remediation has been provided or referenced in the available data.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability, all at low levels.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor channels for updates. Until a fix is available, consider restricting access to the vulnerable function or deploying compensating controls if feasible.