CVE-2026-23878 MEDIUM

CVE-2026-23878: HotCRP vulnerable to exposure of submitted documents

Vendor Kohler

Product hotcrp

Weakness CWE-201

Published January 19, 2026

Last update January 20, 2026

View on NVD All CVEs

CVSS base score

6.5/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0, authors with at least one submission on a HotCRP site could use the document API to download any documents (PDFs, attachments) associated with any submission. The problem was patched in commit ceacd5f1476458792c44c6a993670f02c984b4a0.

Key dates

02Disclosure timeline

January 19, 2026 CVE published

January 20, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-23878 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/201.html

Identifiers

CVE CVE-2026-23878

CWE CWE-201

CVSS 6.5 / MEDIUM

Affected versions

Vendor Kohler

Product hotcrp

Affected >= aa20ef288828b04550950cf67c831af8a525f508, < ceacd5f1476458792c44c6a993670f02c984b4a0