CVE-2026-28276
Received Received - Intake
Unauthorized Access via Unauthenticated File Exposure in Initiative Uploads

Publication date: 2026-02-26

Last updated on: 2026-02-27

Assigner: GitHub, Inc.

Description
Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-26
Last Modified
2026-02-27
Generated
2026-06-16
AI Q&A
2026-02-27
EPSS Evaluated
2026-06-14
NVD
CVE-2026-28276
EUVD
EUVD-2026-8921
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
morelitea initiative to 0.32.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in the Initiative project management platform versions prior to 0.32.2. It is an access control flaw where uploaded documents are stored in a publicly accessible /uploads/ directory without any authentication or authorization checks.

This means that any uploaded file can be accessed directly by anyone via its URL, even if they are not logged in or authenticated, such as through an incognito browser session.

This can lead to the unintended disclosure of sensitive documents.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive documents that were uploaded to the Initiative platform.

Since files are accessible without authentication, confidential or private information could be exposed to anyone who obtains the direct URL.

This exposure could result in data breaches, loss of confidentiality, and potential harm to individuals or organizations relying on the platform for secure document management.

Compliance Impact

I don't know

Detection Guidance

This vulnerability involves uploaded documents being accessible without authentication via the /uploads/ directory. To detect it, you can attempt to access uploaded files directly through their URLs in an unauthenticated context, such as an incognito browser session.

You can also check your server or application logs for requests to the /uploads/ directory from unauthenticated users.

Specific commands to detect this vulnerability are not provided in the available information.

Mitigation Strategies

The vulnerability was patched in Initiative version 0.32.2, with further improvements in version 0.32.4.

Immediate mitigation steps include upgrading your Initiative installation to at least version 0.32.2 or later.

Until the upgrade is applied, restrict public access to the /uploads/ directory by implementing authentication and authorization checks or by configuring your web server to block unauthenticated access to that directory.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart