{"id":"CVE-2026-126955","kind":"vulnerability","aliases":["CVE-2026-126955"],"related":[],"title":"Glance: unauthenticated attackers can discover hidden page names","description":"Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names.","summary":"Glance, a self-hosted dashboard, returns different HTTP status codes for existing and missing page slugs. An unauthenticated attacker can request candidate names and compare 303/401 responses against 404s to find hidden pages.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dashboard","glance","package","self-hosted"],"not_affected_if":["glance-0.8.8-or-later","not-network-exposed"],"how_to_check":"- Check the installed Glance version; affected versions are from `0.8.0` before `0.8.8`\n- Look for pages you meant to keep hidden at `/{page}` and `/api/pages/{page}/content/` from an unauthenticated client","fix":"- Upgrade Glance to `0.8.8` or later","status":"open","published_at":"2026-11-13T10:18:03+00:00","first_seen_at":"2026-11-13T10:47:28+00:00","triaged_at":"2026-11-13T10:54:39+00:00","updated_at":"2026-11-13T10:54:39+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:54:39Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Glance to `0.8.8` or later","reach":"network","title":"Glance: unauthenticated attackers can discover hidden page names","impact":"low","summary":"Glance, a self-hosted dashboard, returns different HTTP status codes for existing and missing page slugs. An unauthenticated attacker can request candidate names and compare 303/401 responses against 404s to find hidden pages.","audience":"businesses","category":"package","nicknames":[],"who_cares":["glance","self-hosted","dashboard"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker learns names of hidden dashboard pages","analyst_note":"Need the sources to confirm whether the fix is exactly 0.8.8 and whether any default config exposes pages.","how_to_check":"- Check the installed Glance version; affected versions are from `0.8.0` before `0.8.8`\n- Look for pages you meant to keep hidden at `/{page}` and `/api/pages/{page}/content/` from an unauthenticated client","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["glance-0.8.8-or-later","not-network-exposed"],"who_is_affected":"Teams running Glance 0.8.0 through 0.8.7 that expose its web interface, including on an internal network reachable by others. The enumeration works without logging in, so any page slug an operator relies on to stay hidden is at risk. Installations on `0.8.8` or later, or not reachable by untrusted clients, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4648,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126955':11A,14A '-2026':10A,13A '/api/pages':86C '/content':88C '0.8.0':57C '0.8.8':59C '303/401':47B,91C '404':93C '404s':50B 'allow':70C 'attack':3A,40B,72C,78C 'candid':43B,81C 'code':31B,95C 'compar':46B,90C 'configur':75C 'contain':60C 'cve':9A,12A 'dashboard':15B,26B 'differ':28B 'discov':5A,97C 'discrep':64C 'enumer':74C 'exist':33B 'find':52B 'glanc':1A,16B,21B,55C 'handlepagecontentrequest':68C 'handlepagerequest':66C 'hidden':6A,53B,98C 'host':20B,25B 'http':29B 'miss':35B 'name':8A,44B,82C,100C 'observ':62C 'packag':17B 'page':7A,36B,54B,76C,84C,87C,99C 'request':42B,80C 'respons':48B,63C 'return':27B 'self':19B,24B 'self-host':18B,23B 'slug':37B,77C 'status':30B,94C 'unauthent':2A,39B,71C 'versus':92C","nicknames":[],"mitigations":[],"who_affected":"Teams running Glance 0.8.0 through 0.8.7 that expose its web interface, including on an internal network reachable by others. The enumeration works without logging in, so any page slug an operator relies on to stay hidden is at risk. Installations on `0.8.8` or later, or not reachable by untrusted clients, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dashboard","glance","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-126955':11A,14A '-2026':10A,13A 'attack':3A 'cve':9A,12A 'discov':5A 'glanc':1A 'hidden':6A 'name':8A 'page':7A 'unauthent':2A","search_b":"'303/401':47B '404s':50B 'attack':40B 'candid':43B 'code':31B 'compar':46B 'dashboard':15B,26B 'differ':28B 'exist':33B 'find':52B 'glanc':16B,21B 'hidden':53B 'host':20B,25B 'http':29B 'miss':35B 'name':44B 'packag':17B 'page':36B,54B 'request':42B 'respons':48B 'return':27B 'self':19B,24B 'self-host':18B,23B 'slug':37B 'status':30B 'unauthent':39B","search_c":"'/api/pages':86C '/content':88C '0.8.0':57C '0.8.8':59C '303/401':91C '404':93C 'allow':70C 'attack':72C,78C 'candid':81C 'code':95C 'compar':90C 'configur':75C 'contain':60C 'discov':97C 'discrep':64C 'enumer':74C 'glanc':55C 'handlepagecontentrequest':68C 'handlepagerequest':66C 'hidden':98C 'name':82C,100C 'observ':62C 'page':76C,84C,87C,99C 'request':80C 'respons':63C 'slug':77C 'status':94C 'unauthent':71C 'versus':92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-07T16:30:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126955","severity":null,"published_at":"2026-11-13T10:18:03+00:00","modified_at":"2026-11-13T10:18:03+00:00","first_seen_at":"2026-11-13T10:47:28+00:00","fetched_at":"2026-11-13T10:47:28+00:00","note":null}],"documents":[{"id":145268,"url":"https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145269,"url":"https://github.com/glanceapp/glance/releases/tag/v0.8.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":145275,"url":"https://github.com/glanceapp/glance/security/advisories/GHSA-294x-cjq2-6j5r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-07T16:30:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145276,"url":"https://www.vulncheck.com/advisories/glance-0.8.0-before-0.8.8-page-slug-enumeration-via-response-discrepancy","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}