---
id: "CVE-2026-126955"
page: "https://infrastack.ai/live/CVE-2026-126955"
kind: "vulnerability"
aliases: ["CVE-2026-126955"]
title: "Glance: unauthenticated attackers can discover hidden page names"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dashboard", "glance", "package", "self-hosted"]
not_affected_if: ["glance-0.8.8-or-later", "not-network-exposed"]
published_at: "2026-11-13T10:18:03+00:00"
first_seen_at: "2026-11-13T10:47:28+00:00"
updated_at: "2026-11-13T10:54:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126955", "first_seen_at": "2026-11-13T10:47:28+00:00"}]
exploit_sources: []
---

# Glance: unauthenticated attackers can discover hidden page names

Link for people: https://infrastack.ai/live/CVE-2026-126955 (this .md is for agents)

Glance, a self-hosted dashboard, returns different HTTP status codes for existing and missing page slugs. An unauthenticated attacker can request candidate names and compare 303/401 responses against 404s to find hidden pages.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Glance version; affected versions are from `0.8.0` before `0.8.8`
- Look for pages you meant to keep hidden at `/{page}` and `/api/pages/{page}/content/` from an unauthenticated client

## Fix

- Upgrade Glance to `0.8.8` or later

## Timeline

- 2026-11-13T10:47:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126955

## Documents

- [advisory] Vendor advisory: github.com https://github.com/glanceapp/glance/security/advisories/GHSA-294x-cjq2-6j5r
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/glance-0.8.0-before-0.8.8-page-slug-enumeration-via-response-discrepancy
- [fix] Patch: github.com https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244
- [fix] Release notes: github.com https://github.com/glanceapp/glance/releases/tag/v0.8.8

## From the sources

Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_