Vulnerability Description
Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Morelitea | Initiative | < 0.32.2 |
Related Weaknesses (CWE)
References
- https://github.com/Morelitea/initiative/releases/tag/v0.32.2ProductRelease Notes
- https://github.com/Morelitea/initiative/security/advisories/GHSA-w34j-fx72-h2pqVendor Advisory
FAQ
What is CVE-2026-28276?
CVE-2026-28276 is a vulnerability with a CVSS score of 7.5 (HIGH). Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /u...
How severe is CVE-2026-28276?
CVE-2026-28276 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-28276?
Check the references section above for vendor advisories and patch information. Affected products include: Morelitea Initiative.