CVE-2026-28276

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28276", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-26T01:52:58.734Z", "datePublished": "2026-02-26T22:57:36.406Z", "dateUpdated": "2026-02-27T17:40:15.760Z"}, "containers": {"cna": {"title": "Initiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Morelitea/initiative/security/advisories/GHSA-w34j-fx72-h2pq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Morelitea/initiative/security/advisories/GHSA-w34j-fx72-h2pq"}, {"name": "https://github.com/Morelitea/initiative/releases/tag/v0.32.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/Morelitea/initiative/releases/tag/v0.32.2"}], "affected": [{"vendor": "Morelitea", "product": "initiative", "versions": [{"version": "< 0.32.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:57:36.406Z"}, "descriptions": [{"lang": "en", "value": "Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4."}], "source": {"advisory": "GHSA-w34j-fx72-h2pq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T17:37:27.019868Z", "id": "CVE-2026-28276", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:40:15.760Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28276", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T17:37:27.019868Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T17:37:39.411Z"}}], "cna": {"title": "Initiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ Endpoint", "source": {"advisory": "GHSA-w34j-fx72-h2pq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Morelitea", "product": "initiative", "versions": [{"status": "affected", "version": "< 0.32.2"}]}], "references": [{"url": "https://github.com/Morelitea/initiative/security/advisories/GHSA-w34j-fx72-h2pq", "name": "https://github.com/Morelitea/initiative/security/advisories/GHSA-w34j-fx72-h2pq", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Morelitea/initiative/releases/tag/v0.32.2", "name": "https://github.com/Morelitea/initiative/releases/tag/v0.32.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T22:57:36.406Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28276", "state": "PUBLISHED", "dateUpdated": "2026-02-27T17:40:15.760Z", "dateReserved": "2026-02-26T01:52:58.734Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T22:57:36.406Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "initiative", "vendor": "Morelitea", "versions": [{"status": "affected", "version": "< 0.32.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:morelitea:initiative:*:*:*:*:*:*:*:*", "matchCriteriaId": "14E07E5B-5651-4A27-86E2-CE508B70B3B6", "versionEndExcluding": "0.32.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4."}, {"lang": "es", "value": "Initiative es una plataforma de gesti\u00f3n de proyectos autoalojada. Existe una vulnerabilidad de control de acceso en las versiones de Initiative anteriores a la 0.32.2 donde los documentos subidos se sirven desde un directorio /uploads/ de acceso p\u00fablico sin ninguna comprobaci\u00f3n de autenticaci\u00f3n o autorizaci\u00f3n. Cualquier archivo subido puede ser accedido directamente a trav\u00e9s de su URL por usuarios no autenticados (por ejemplo, en una sesi\u00f3n de navegador de inc\u00f3gnito), lo que lleva a la posible divulgaci\u00f3n de documentos sensibles. El problema fue parcheado en la v0.32.2, y el parche fue mejorado a\u00fan m\u00e1s en la 0.32.4."}], "id": "CVE-2026-28276", "lastModified": "2026-06-17T10:28:25.050", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28276", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T17:37:27.019868Z", "version": "2.0.3"}}]}, "published": "2026-02-26T23:16:37.397", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/Morelitea/initiative/releases/tag/v0.32.2"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/Morelitea/initiative/security/advisories/GHSA-w34j-fx72-h2pq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.32.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "initiative", "source": "cna", "vendor": "Morelitea"}, "product": "initiative", "vendor": "morelitea"}], "analysis": {"en": {"generated_at": "2026-04-17T14:12:33.549805+00:00", "value": {"mitigation_remediation": ["Upgrade to version 0.32.2 or later to apply the vendor-supplied fix that enforces authentication on /uploads/.", "If an upgrade is not yet possible, configure the web server or reverse proxy to block public access to the /uploads/ directory and require authentication.", "Implement monitoring of file access logs to detect unauthorized retrievals and validate that the access control policy is enforced."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Disclosure of Uploaded Documents"}, "threat_synthesis": {"affected_systems": "The affected product is Morelitea Initiative. All installations running versions earlier than 0.32.2 are vulnerable. The vendor has released version 0.32.2 and a further improvement in 0.32.4 that address the issue.", "description_and_impact": "Initiative is a self-hosted project management platform. Versions before 0.32.2 lack authentication checks when serving documents from the /uploads/ directory. This flaw allows any user to request a file by URL and receive its contents without verification, resulting in confidential data exposure.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a medium\u2013high severity, while the EPSS score of less than 1% suggests a low probability of active exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by simply accessing the file URL, bypassing any authentication mechanisms. A successful exploitation would allow an attacker to read any document uploaded by users, compromising confidentiality and potentially exposing sensitive project data."}}}}, "created": "2026-02-27T09:03:44.173118+00:00", "updated": "2026-04-17T14:15:21.817958+00:00", "vendors": ["morelitea", "morelitea$PRODUCT$initiative"]}