ZeroDay Findings
Sign inSign up

Findings

CVE-2026-28276

Initiative is a self-hosted project management platform.

Published Feb 26, 2026 · updated Jun 17, 2026 · morelitea initiative

Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 26, 2026 · NIST NVD

    Detected

    Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading t

  2. Jun 17, 2026 · NIST NVD

    Updated

    Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading t

Affected

  • cpe morelitea/initiativeversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-28276

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-28276

    Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any upload

    nvd.nist.gov

References