Auth bypass in Morelitea Initiative
CVE-2026-28276
Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (44.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 44.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.006 · change: +0.002
Affected products
- Morelitea Initiative — versions < 0.32.2
Weakness classification (CWE)
References
- github.com/Morelitea/initiative/security/advisories/GHSA-w34j-fx72-h2pq (Vendor Advisory)
- github.com/Morelitea/initiative/releases/tag/v0.32.2 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-28276?
- CVE-2026-28276 is a high-severity vulnerability in Morelitea Initiative, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-02-26.
- How severe is CVE-2026-28276?
- High severity. CVSS v3 base score is 7.5 out of 10.