CVE-2026-55493

Name of the Vulnerable Software and Affected Versions HotCRP versions 2.101 through 3.3

Description An issue exists where the cmt: search term verifies if a comment is visible to the user but fails to verify if the commenter's identity should be hidden. Consequently, using a cmt:USER search can match a paper with a visible comment authored by a specific user, even if that comment is intended to be anonymous. This allows an authenticated user with search access to infer the author of an anonymous comment, which compromises reviewer anonymity. Comments that are not visible to the user continue to be excluded from search results.

Recommendations Update to version 3.3 or later.