Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-55493HotCRP: comment-author search exposes anonymous commenter identities

Medium 6.5

In plain English

A medium-severity incorrect authorization in hotcrp from kohler. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 77.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A `cmt:USER` search can therefore match a paper with a visible comment authored by USER even when the comment is supposed to be anonymous. An authenticated user with access to the search can infer the author of an anonymous comment, compromising reviewer anonymity. Comments that the user cannot see remain excluded from search results. The advisory prose identifies 3.3 as fixed, its affected-version metadata excludes 3.3, and the verified repository tag 3.3 already contains the identity-check fix; however, its patched-version metadata instead lists 3.3.1. This fixed-version source conflict remains unresolved.

Affected products (as reported)

Vendor	Product	Versions
kohler	hotcrp	>= 2.101, < 3.3

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/kohler/hotcrp/security/advisories/GHSA-x3g6-4c5h-7p29 x_refsource_CONFIRM
https://github.com/kohler/hotcrp/commit/c4b008e756650db3063e8dd8300127936aae9ec1 x_refsource_MISC
https://github.com/kohler/hotcrp/releases/tag/v3.3 x_refsource_MISC