PT-2026-3478 · Hotcrp · Hotcrp

Kohler · Publicado 2026-01-19 · Atualizado 2026-01-19 · CVE-2026-23878

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HotCRP versions prior to ceacd5f1476458792c44c6a993670f02c984b4a0

Description HotCRP is conference review software. Authors with at least one submission on a HotCRP site could use the document API to download any documents (PDFs, attachments) associated with any submission. The issue stems from insufficient access controls within the document API, allowing unauthorized document retrieval. The vulnerable functionality involves the use of the document API.

Recommendations Update HotCRP to commit ceacd5f1476458792c44c6a993670f02c984b4a0 or a later version to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-201

Identificadores relacionados

CVE-2026-23878

GHSA-VH3X-XWJ4-JVQX

Produtos afetados

Hotcrp

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23878.json · Exploit
• https://github.com/kohler/hotcrp/commit/aa20ef288828b04550950cf67c831af8a525f508 · Correção
• https://github.com/kohler/hotcrp/commit/ceacd5f1476458792c44c6a993670f02c984b4a0 · Correção
• https://github.com/kohler/hotcrp/security/advisories/GHSA-vh3x-xwj4-jvqx · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-23878 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23878 · Nota de Segurança
• https://twitter.com/CVEnew/status/2013316904488694109 · Publicação no Twitter