CVE-2026-126955 json
Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy
published 7d ago modified yesterday also EUVD-2026-125110 , GHSA-294x-cjq2-6j5r
Unreviewed: the maintainers' own advisory
Published by the maintainers on their GitHub repository glanceapp/glance. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names.
Patch / fix
- glanceapp glance 0.8.8
Is CVE-2026-126955 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- yesterday
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-14).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- glanceapp glance
Classification
- Weakness
-
- CWE-204 Observable Response Discrepancy
References
-
github.com
/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244
patch
-
github.com
/glanceapp/glance/security/advisories/GHSA-294x-cjq2-6j5r
vendor-advisory, advisory
-
github.com
/glanceapp/glance/blob/v0.8.7/internal/glance/glance.go#L306-L316
technical-description
-
github.com
/glanceapp/glance/releases/tag/v0.8.8
release-notes
-
vulncheck.com
/advisories/glance-0.8.0-before-0.8.8-page-slug-enumeration-via-response-discrepancy
third-party-advisory
Sources
- CVE List CVE-2026-126955
- NVD CVE-2026-126955
- Maintainer advisory GHSA-294x-cjq2-6j5r
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of glanceapp/glance published their own advisory on GitHub. Reviewed sources take precedence over it.