CVE-2026-55493
HotCRP: comment-author search exposes anonymous commenter identities
HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A `cmt:USER` search can therefore match a paper with a visible comment authored by USER even when the comment is supposed to be anonymous. An authenticated user with access to the search can infer the author of an anonymous comment, compromising reviewer anonymity. Comments that the user cannot see remain excluded from search results. The advisory prose identifies 3.3 as fixed, its affected-version metadata excludes 3.3, and the verified repository tag 3.3 already contains the identity-check fix; however, its patched-version metadata instead lists 3.3.1. This fixed-version source conflict remains unresolved.
Fixes and workarounds
Fix
HotCRP: GitHub reports patched versions 3.3.1. Check the advisory for the affected release branch.
Source: GitHub GHSA-x3g6-4c5h-7p29Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| hotcrp kohler |
>= 2.101, < 3.3 (affected) | CNA: GitHub_M |
HotCRPHotCRP
|
< 3.3 (affected, GitHub advisory range) | GitHub GHSA-x3g6-4c5h-7p29 |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 6.5 medium |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CNA: GitHub_M |
| 3.1 / 6.5 medium |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD: [email protected] |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://github.com/kohler/hotcrp/security/advisories/GHSA-x3g6-4c5h-7p29CNA: GitHub_M · x_refsource_CONFIRM
- https://github.com/kohler/hotcrp/commit/c4b008e756650db3063e8dd8300127936aae9ec1CNA: GitHub_M · x_refsource_MISC
- https://github.com/kohler/hotcrp/releases/tag/v3.3CNA: GitHub_M · x_refsource_MISC
- https://github.com/kohler/hotcrp/commit/c4b008e756650db3063e8dd8300127936aae9ec1[email protected]
- https://github.com/kohler/hotcrp/releases/tag/v3.3[email protected]
- https://github.com/kohler/hotcrp/security/advisories/GHSA-x3g6-4c5h-7p29[email protected]
- https://github.com/kohler/hotcrp/security/advisories/GHSA-x3g6-4c5h-7p29GitHub Security Advisories · advisory
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.