What is the CVSS score of CVE-2026-28276?

CVE-2026-28276 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Initiative are affected by CVE-2026-28276?

Initiative project management platforms are exposing all uploaded documents publicly without authentication, allowing unauthorized access to potentially sensitive project files, plans, and…

How to fix or mitigate CVE-2026-28276?

Within 24 hours: Audit Initiative deployment version and identify all instances running versions prior to 0.32.2; disable document upload functionality if possible or restrict /uploads/ directory access at the network/firewall level. Within 7 days: Implement WAF rules to require authentication before accessing /uploads/ directory; conduct forensic review of access logs to identify potential unauthorized document access. Within 30 days: Coordinate with Initiative development team for patch release timeline; plan and execute upgrade to patched version; conduct security awareness training on data classification for users.

Initiative CVE-2026-28276

HIGH

Information Exposure (CWE-200)

2026-02-26 security-advisories@github.com

Authentication Bypass Information Disclosure Initiative Morelitea

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Feb 26, 2026 - 23:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4.

AnalysisAI

Unauthenticated access to uploaded files in Initiative project management platform prior to version 0.32.2 allows remote attackers to retrieve sensitive documents by directly accessing the unprotected /uploads/ directory. The vulnerability stems from missing authentication and authorization controls on file serving, enabling disclosure of confidential project data without requiring any credentials. Initiative versions 0.32.2 and later contain patches to restrict access to uploaded documents.

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects Initiative. Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was