PT-2026-22224 · Unknown · Initiative

Highjordandrakop · Publicado 2026-02-26 · Atualizado 2026-03-03 · CVE-2026-28276

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Initiative versions prior to 0.32.2

Description An access control issue exists in Initiative, a self-hosted project management platform. Uploaded documents are served from a publicly accessible /uploads/ directory without authentication or authorization checks. This allows unauthenticated users to access any uploaded file directly via its URL, potentially leading to the disclosure of sensitive documents.

Recommendations Update to version 0.32.2 or later.

Exploit

Correção

Missing Authorization

Information Disclosure

Improper Access Control

Enumeração de Fraquezas

CWE-862

CWE-200

CWE-284

Identificadores relacionados

CVE-2026-28276

GHSA-W34J-FX72-H2PQ

Produtos afetados

Initiative

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28276.json · Exploit
• https://github.com/Morelitea/initiative/security/advisories/GHSA-w34j-fx72-h2pq · Aviso do Fabricante
• https://github.com/Morelitea/initiative/releases/tag/v0.32.2 · Nota
• https://twitter.com/VulmonFeeds/status/2027172656420720891 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-28276 · Nota de Segurança
• https://twitter.com/cracbot/status/2028787705396830365 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027466630331326763 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-28276 · Aviso do Fabricante