CVE-2026-23878

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-23878

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23878.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-23878

Aliases

GHSA-vh3x-xwj4-jvqx

Published

2026-01-19T18:08:41.100Z

Modified

2026-07-15T01:49:18.377363608Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

HotCRP vulnerable to exposure of submitted documents

Details

HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0, authors with at least one submission on a HotCRP site could use the document API to download any documents (PDFs, attachments) associated with any submission. The problem was patched in commit ceacd5f1476458792c44c6a993670f02c984b4a0.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "aa20ef288828b04550950cf67c831af8a525f508"
                },
                {
                    "fixed": "ceacd5f1476458792c44c6a993670f02c984b4a0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-201"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23878.json"
}

References

Affected packages

Git / github.com/kohler/hotcrp

Affected ranges

Type

GIT

Repo

https://github.com/kohler/hotcrp

Events

Introduced

85b8130454f00d1b510c4488e2a7d8bcdb55fe7b

Fixed

aa20ef288828b04550950cf67c831af8a525f508

Fixed

ceacd5f1476458792c44c6a993670f02c984b4a0

Database specific

{
    "extracted_events": [
        {
            "introduced": "3.1"
        },
        {
            "last_affected": "3.1"
        }
    ],
    "cpe": "cpe:2.3:a:hotcrp:hotcrp:3.1:*:*:*:*:*:*:*",
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

3.*

3.1

v3.*

v3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-23878.json"