PT-2026-22224 · Unknown · Initiative

Highjordandrakop · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-28276

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Initiative versions prior to 0.32.2

Description An access control issue exists in Initiative, a self-hosted project management platform. Uploaded documents are served from a publicly accessible /uploads/ directory without authentication or authorization checks. This allows unauthenticated users to access any uploaded file directly via its URL, potentially leading to the disclosure of sensitive documents.

Recommendations Update to version 0.32.2 or later.

Exploit

Fix

Missing Authorization

Information Disclosure

Improper Access Control

Weakness Enumeration

CWE-862

CWE-200

CWE-284

Related Identifiers

CVE-2026-28276

GHSA-W34J-FX72-H2PQ

Affected Products

Initiative

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28276.json · Exploit
• https://github.com/Morelitea/initiative/security/advisories/GHSA-w34j-fx72-h2pq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28276 · Security Note
• https://osv.dev/vulnerability/CVE-2026-28276 · Vendor Advisory
• https://github.com/Morelitea/initiative/releases/tag/v0.32.2 · Note
• https://twitter.com/VulmonFeeds/status/2027172656420720891 · Twitter Post
• https://twitter.com/cracbot/status/2028787705396830365 · Twitter Post
• https://twitter.com/CVEnew/status/2027466630331326763 · Twitter Post