Read the docs
TI-2026-25695 Aliases CVE-2026-33284

GlobalLeaks has insufficient URL validation in user support API

Priority MEDIUM 41CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00203 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed globaleaks-whistleblowing-software (globaleaks): 5.0.89

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
globaleaksglobaleaks-whistleblowing-softwarebefore 5.0.895.0.89Patch availableCNA
  • globaleaks-whistleblowing-software Vendorglobaleaks Affected before 5.0.89 Fixed in 5.0.89 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:globaleaks:globaleaks:*:*:*:*:*:*:*:*before 5.0.89Vulnerableglobaleaks
  • cpe:2.3:a:globaleaks:globaleaks:*:*:*:*:*:*:*:* Versions before 5.0.89 Vulnerable ·globaleaks

Remediation

  • Fix · CNA globaleaks-whistleblowing-software (globaleaks) Fixed in 5.0.89

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33284

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences