Read the docs
TI-2026-83340 Aliases CVE-2026-55493

HotCRP comment search exposes anonymous commenter identities

Priority LOW 29CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

HotCRP from 2.101 before 3.3 is affected. The cmt: search term checks whether a comment is visible to the searching user but does not check whether the commenter's identity should be shown, which is CWE-863 (Incorrect Authorization). An authenticated user with search access can match a paper to an anonymous comment by a given author and so infer that author, which compromises reviewer anonymity.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A `cmt:USER` search can therefore match a paper with a visible comment authored by USER even when the comment is supposed to be anonymous. An authenticated user with access to the search can infer the author of an anonymous comment, compromising reviewer anonymity. Comments that the user cannot see remain excluded from search results. The advisory prose identifies 3.3 as fixed, its affected-version metadata excludes 3.3, and the verified repository tag 3.3 already contains the identity-check fix; however, its patched-version metadata instead lists 3.3.1. This fixed-version source conflict remains unresolved.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.003 22nd percentileScored 2026-11-07
Fix Fixed hotcrp (kohler): 3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kohlerhotcrp2.101 to before 3.33.3Patch availableCNA
  • hotcrp Vendorkohler Affected 2.101 to before 3.3 Fixed in 3.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:hotcrp:hotcrp:*:*:*:*:*:*:*:*——kohler
  • cpe:2.3:a:hotcrp:hotcrp:*:*:*:*:*:*:*:* Versions — — ·kohler

Remediation

Upgrade HotCRP to version 3.3 or later. The advisory prose identifies 3.3 as the fixed version and the repository tag 3.3 contains the fix, but the patched-version metadata lists 3.3.1, so the sources conflict on the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA hotcrp (kohler) Fixed in 3.3

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-55493
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-05 CISA SSVC decision points changed

References

Other 3

  • TI-2026-19199 HotCRP vulnerable to remote code execution through formulas CVSS 3.1CRITICAL 10.0
  • TI-2026-19236 HotCRP vulnerable to exposure of submitted documents CVSS 3.1MEDIUM 6.5
  • TI-2026-20318 HotCRP vulnerable to stored XSS via comment attachments CVSS 3.1HIGH 7.3
  • TI-2022-04415 HotCRP cross site scripting CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences