PT-2026-3478 · Hotcrp · Hotcrp

Kohler · Published 2026-01-19 · Updated 2026-01-19 · CVE-2026-23878

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HotCRP versions prior to ceacd5f1476458792c44c6a993670f02c984b4a0

Description HotCRP is conference review software. Authors with at least one submission on a HotCRP site could use the document API to download any documents (PDFs, attachments) associated with any submission. The issue stems from insufficient access controls within the document API, allowing unauthorized document retrieval. The vulnerable functionality involves the use of the document API.

Recommendations Update HotCRP to commit ceacd5f1476458792c44c6a993670f02c984b4a0 or a later version to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-23878

GHSA-VH3X-XWJ4-JVQX

Affected Products

Hotcrp

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23878.json · Exploit
• https://github.com/kohler/hotcrp/commit/aa20ef288828b04550950cf67c831af8a525f508 · Patch
• https://github.com/kohler/hotcrp/commit/ceacd5f1476458792c44c6a993670f02c984b4a0 · Patch
• https://github.com/kohler/hotcrp/security/advisories/GHSA-vh3x-xwj4-jvqx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23878 · Security Note
• https://twitter.com/CVEnew/status/2013316904488694109 · Twitter Post