# CVE-2026-55493: HotCRP: comment-author search exposes anonymous commenter identities

Status: published. Published: 2026-10-30. Updated: 2026-11-05.

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A `cmt:USER` search can therefore match a paper with a visible comment authored by USER even when the comment is supposed to be anonymous. An authenticated user with access to the search can infer the author of an anonymous comment, compromising reviewer anonymity. Comments that the user cannot see remain excluded from search results. The advisory prose identifies 3.3 as fixed, its affected-version metadata excludes 3.3, and the verified repository tag 3.3 already contains the identity-check fix; however, its patched-version metadata instead lists 3.3.1. This fixed-version source conflict remains unresolved.

## Remediation

- fix: HotCRP: GitHub reports patched versions 3.3.1. Check the advisory for the affected release branch. (source: GitHub GHSA-x3g6-4c5h-7p29) — https://github.com/kohler/hotcrp/security/advisories/GHSA-x3g6-4c5h-7p29

## Affected products and versions

- kohler / hotcrp: >= 2.101, < 3.3 (affected). Source: CNA: GitHub_M
-  / HotCRP (HotCRP): < 3.3 (affected, GitHub advisory range). Source: GitHub GHSA-x3g6-4c5h-7p29

## Severity and prioritization

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: CNA: GitHub_M

- CVSS 3.1: 6.5 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; source: NVD: security-advisories@github.com

- CISA KEV: No listing in collected sources

- EPSS: 0.30% as of 2026-11-04; percentile 22.90%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-863

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/kohler/hotcrp/security/advisories/GHSA-x3g6-4c5h-7p29 (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/kohler/hotcrp/commit/c4b008e756650db3063e8dd8300127936aae9ec1 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/kohler/hotcrp/releases/tag/v3.3 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/kohler/hotcrp/commit/c4b008e756650db3063e8dd8300127936aae9ec1 (security-advisories@github.com)

- https://github.com/kohler/hotcrp/releases/tag/v3.3 (security-advisories@github.com)

- https://github.com/kohler/hotcrp/security/advisories/GHSA-x3g6-4c5h-7p29 (security-advisories@github.com)

- https://github.com/kohler/hotcrp/security/advisories/GHSA-x3g6-4c5h-7p29 (GitHub Security Advisories; advisory)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-55493; retrieved 2026-11-05; source updated 2026-11-05

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55493; retrieved 2026-11-03; source updated 2026-11-02

- GitHub Security Advisories: https://github.com/kohler/hotcrp/security/advisories/GHSA-x3g6-4c5h-7p29; retrieved 2026-11-03; source updated 2026-07-23

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-55493; retrieved 2026-11-05; source updated Not reported

Revision: 5aa980a414f695026633018e01ee1015397bdca8b65d73fec6c204158580a9f2

Canonical: https://y2.dev/cve/CVE-2026-55493

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.