Medium severity6.5OSV Advisory· Published Jan 19, 2026· Updated Jun 17, 2026

CVE-2026-23878

Description

HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0, authors with at least one submission on a HotCRP site could use the document API to download any documents (PDFs, attachments) associated with any submission. The problem was patched in commit ceacd5f1476458792c44c6a993670f02c984b4a0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Kohler/HotcrpOSV
Range: SITE_HotNetsV, v2.0, v2.0b1, …
Hotcrp/hotcrp2 versions
cpe:2.3:a:hotcrp:hotcrp:3.1:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:hotcrp:hotcrp:3.1:*:*:*:*:*:*:*
- (no CPE)

Patches

Vulnerability mechanics

References

github.com/kohler/hotcrp/commit/aa20ef288828b04550950cf67c831af8a525f508nvdPatch
github.com/kohler/hotcrp/commit/ceacd5f1476458792c44c6a993670f02c984b4a0nvdPatch
github.com/kohler/hotcrp/security/advisories/GHSA-vh3x-xwj4-jvqxnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000