SZB-8e1fdd0cea
EUVD-2026-114367 reports comment-visibility check flaw in HotCRP search
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- HotCRP
- Product
- hotcrp
- First seen
Summary
The EUVD listing says that starting with HotCRP 2.101, the cmt: search term checks whether a comment is visible but does not check whether the commenter's identity should be visible. It assigns a CVSS v3.1 score of 6.5.
If you use HotCRP
Upgrade HotCRP to a fixed release
Review whether commenter identities should be hidden for affected review submissions
Check EUVD-2026-114367 for fixed versions
What the sources say 1
· Mastodon: “Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible.” Source