HotCRP EUVD-2026-114367

Requires an authenticated account with access to HotCRP's paper search. A target paper must have a comment that is visible to the attacker but whose commenter identity is configured to be hidden - the test case reproduces this with reviews/comments viewable (viewrev) while reviewer identities are concealed (viewrevid never), the classic anonymous/double-blind setup. The attacker must also enumerate or guess candidate usernames to probe via cmt:USER. Limiting factors: authentication is required (PR:L, no unauthenticated path); the disclosure only works where comment content is already visible but identity is withheld, and comments the user cannot see at all remain excluded from results. The flaw has existed since v2.101 (2017).

This is a moderate, confidentiality-only authorization flaw (CWE-863), not a high-urgency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) shows network reach and low complexity but requires authentication (PR:L), and the impact is limited to information disclosure with no integrity or availability effect. The vendor itself rates the issue 'Moderate.' Note a signal tension: the vector encodes C:H, yet the actual disclosure is narrow - it reveals only the identity of an already-visible anonymous comment to a user who can already read that comment - which is closer to a low/limited confidentiality impact than a full confidentiality breach. There is no CISA KEV listing and no EPSS score in the provided data, so widespread or automated exploitation cannot be inferred; the vuln.today decision label is 'this_month' (routine prioritization, not act_now/emergency). No public exploit code is present - the GitHub references are the advisory, the fix commit, and the release tag, not weaponized PoC. The real priority driver is contextual: for venues running double-blind peer review, breaking reviewer anonymity is a meaningful trust/process harm even though the technical CVSS is mid-range. A fixed-version conflict is unresolved in the source data (advisory prose and repo tag say 3.3; patched-version metadata says 3.3.1) and should be verified before remediation tracking.

An authenticated HotCRP user (e.g., a reviewer) who can see an anonymous comment on a paper but is not permitted to see its author runs cmt:USER searches naming candidate accounts; when the paper matches, the attacker learns that USER authored the supposedly anonymous comment. No public exploit code exists, but the attack requires only ordinary search queries, so it is trivial for anyone with search access. The attack vector is network-based with low complexity, limited only by needing a valid authenticated account.