{"id":"CVE-2026-56355","aliases":["EUVD-2026-38135","GHSA-g7v6-x8xj-fvjm"],"status":"published","title":"GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.","description":"GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00404,"percentile":0.34894,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-696"],"published":"2026-06-20T20:08:05Z","modified":"2026-10-25T23:10:00Z","products":[{"vendor":"gnu","product":"savane"}],"references":[{"url":"https://cgit.git.savannah.gnu.org/cgit/administration/savane.git/tree/frontend/php/file.php?h=release-3.17#n113"},{"url":"https://cgit.git.savannah.gnu.org/cgit/administration/savane.git/tree/frontend/php/file.php?h=release-3.17#n123"},{"url":"https://www.fsf.org/news/statement-regarding-gnu-savannah-security-reports"},{"url":"https://www.hacktron.ai"},{"url":"https://www.mallory.ai/stories/019ee445-bdd4-7775-93b5-a8faaf5c2eb7"},{"url":"https://news.ycombinator.com/item?id=48605220"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56355"},{"url":"https://github.com/advisories/GHSA-g7v6-x8xj-fvjm"}],"sources":{"cve":[{"id":"CVE-2026-56355","description":"GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.","status":"published","published":"2026-06-20T20:08:05.163Z","modified":"2026-06-22T17:21:17.681Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-696"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-38135","description":"GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.","status":"published","published":"2026-06-20T20:08:05Z","modified":"2026-06-22T17:21:17Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T18:20:34.238696Z"}],"ghsa":[{"id":"GHSA-g7v6-x8xj-fvjm","title":"GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.","description":"GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.","status":"published","published":"2026-06-20T21:31:24Z","modified":"2026-06-20T21:31:30Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-696"],"updated_at":"2026-11-02T15:08:55.672723Z"}],"nvd":[{"id":"CVE-2026-56355","description":"GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.","status":"published","published":"2026-06-20T21:16:54.293Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-696"],"updated_at":"2026-11-02T14:12:24.912854Z"}]}}