CVE-2026-126955 · Package
NO FIX YET · SEE WHAT TO DO
Glance, a self-hosted dashboard, returns different HTTP status codes for existing and missing page slugs. An unauthenticated attacker can request candidate names and compare 303/401 responses against 404s to find hidden pages.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Glance 0.8.0 through 0.8.7 that expose its web interface, including on an internal network reachable by others. The enumeration works without logging in, so any page slug an operator relies on to stay hidden is at risk. Installations on 0.8.8 or later, or not reachable by untrusted clients, can skip it.
Not affected if glance-0.8.8-or-later, not-network-exposed
Who cares dashboard, glance, self-hosted
0.8.0 before 0.8.8/{page} and /api/pages/{page}/content/ from an unauthenticated client0.8.8 or laterGlance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.