CVE-2026-55493 in HotCRP
Summary
by MITRE • 10/30/2026
HotCRP is conference review software. Starting with 2.101, the `cmt:` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A `cmt:USER` search can therefore match a paper with a visible comment authored by USER even when the comment is supposed to be anonymous. An authenticated user with access to the search can infer the author of an anonymous comment, compromising reviewer anonymity. Comments that the user cannot see remain excluded from search results. The advisory prose identifies 3.3 as fixed, its affected-version metadata excludes 3.3, and the verified repository tag 3.3 already contains the identity-check fix; however, its patched-version metadata instead lists 3.3.1. This fixed-version source conflict remains unresolved.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/30/2026
HotCRP is a widely used conference management platform that facilitates peer review processes for academic and professional conferences by managing paper submissions, reviewer assignments, and comment threads. A critical security flaw exists within the search functionality introduced in version 2.101, specifically concerning the handling of anonymous comments during query execution. The vulnerability stems from an incomplete access control check implemented when processing searches that utilize the `cmt:` operator to filter results based on specific user interactions or comments. While the system correctly verifies whether a particular comment is visible to the searching user according to general visibility rules, it fails to validate whether the identity of the commenter associated with that comment should remain hidden from the searcher. This logical gap allows an authenticated attacker who has access to the search interface to perform targeted queries using the `cmt:USER` syntax.
When such a query is executed against papers containing anonymous comments authored by the specified user, HotCRP returns those papers in the results if any comment made by that user is visible to the searcher, regardless of whether the specific comment itself or its author's identity should be concealed under anonymity policies. This behavior effectively bypasses the intended privacy controls designed to protect reviewer identities during blind peer review processes. An adversary can exploit this discrepancy by systematically searching for comments attributed to various users and observing which papers appear in the results. By correlating these search outcomes with known submission patterns or other metadata, an attacker can infer the identity of reviewers who are supposed to remain anonymous, thereby compromising the integrity of the double-blind or single-blind review process depending on the conference's specific configuration.
The operational impact of this vulnerability is significant for conferences relying on HotCRP to maintain fair and unbiased evaluation processes. Reviewer anonymity is a cornerstone of effective peer review, as it encourages honest feedback without fear of retaliation or bias from authors. The ability to de-anonymize reviewers undermines trust in the platform and can lead to professional repercussions for reviewers who feel their privacy has been violated. Although the vulnerability description indicates that version 3.3 contains the fix within its source code and repository tags, there is a documented inconsistency in the metadata reporting where the patched-version field lists 3.3.1 instead of 3.3. This discrepancy creates confusion regarding which specific releases are truly secure, potentially leading administrators to believe they are running a fixed version when they may still be vulnerable if they have not upgraded past the initial release that introduced the flaw but before the corrected metadata was published.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials or Identifiers in logic flows where identity verification is bypassed. In terms of the MITRE ATT&CK framework, it relates to techniques involving Discovery and potentially Impair Defenses if used to intimidate reviewers into withdrawing from future reviews. To mitigate this risk, administrators must ensure they are running a version that explicitly includes the fix for anonymous comment visibility checks in search queries. It is crucial to verify the actual code state rather than relying solely on metadata labels due to the reported inconsistency between fixed and patched versions. Upgrading to the confirmed secure release where both source tags and package metadata align correctly will resolve the issue. Additionally, organizations should implement strict access controls for conference management systems and regularly audit their configurations against current security advisories to prevent similar logical flaws from being exploited in production environments.