{"id":"CVE-2026-68511","kind":"vulnerability","aliases":["CVE-2026-68511"],"related":[],"title":"Paaster: concurrent requests bypass view-once paste deletion","description":"Paaster is a pastebin application. Prior to version 3.3.0, Paaster's \"view once\" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as \"not yet read\" and all successfully retrieve it. This issue has been patched in version 3.3.0.","summary":"Paaster is a pastebin, and its view-once mode is meant to let a paste be read only once. Because the check and the update are not atomic, parallel requests can all read the same paste before it is marked as read.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","paaster","pastebin","self-hosted"],"not_affected_if":["version-3.3.0-or-later","view-once-unused"],"how_to_check":"- Check the installed Paaster version; versions below `3.3.0` are affected.\n- Confirm whether the instance has view-once (burn-after-reading) pastes enabled.","fix":"- Paaster: upgrade to `3.3.0` or later.","status":"open","published_at":"2026-11-11T22:17:30+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","triaged_at":"2026-11-11T22:34:01+00:00","updated_at":"2026-11-11T22:34:01+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T22:34:01Z","model":"claude-haiku-5-5","output":{"fix":"- Paaster: upgrade to `3.3.0` or later.","reach":"internet","title":"Paaster: concurrent requests bypass view-once paste deletion","impact":"low","summary":"Paaster is a pastebin, and its view-once mode is meant to let a paste be read only once. Because the check and the update are not atomic, parallel requests can all read the same paste before it is marked as read.","audience":"businesses","category":"other","nicknames":[],"who_cares":["paaster","self-hosted","pastebin"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"a one-time paste is read by more than one requester","analyst_note":"","how_to_check":"- Check the installed Paaster version; versions below `3.3.0` are affected.\n- Confirm whether the instance has view-once (burn-after-reading) pastes enabled.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-3.3.0-or-later","view-once-unused"],"who_is_affected":"Any team that self-hosts Paaster before 3.3.0 and uses its view-once paste mode is exposed, since one paste can be retrieved by several concurrent requests. Instances that do not use view-once pastes, or that already run 3.3.0 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4601,"output_tokens":482,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-68511':12A,15A '3.3.0':73C,137C 'applic':69C 'atom':50B,111C 'burn':79C 'burn-after-read':78C 'bypass':4A,86C 'check':44B,91C 'concurr':2A,88C 'cve':10A,13A 'delet':9A 'enforc':96C 'follow':104C 'host':21B 'issu':131C 'let':35B 'mark':62B 'meant':33B 'mode':31B,83C 'multipl':113C 'paaster':1A,17B,22B,65C,74C 'parallel':51B 'past':8A,37B,58B,82C,120C 'pastebin':18B,25B,68C 'patch':134C 'plain':102C 'prior':70C 'read':39B,55B,64B,81C,103C,124C 'request':3A,52B,89C,115C 'retriev':128C 'see':118C 'self':20B 'self-host':19B 'separ':107C 'simultan':114C 'singl':98C 'single-us':97C 'success':127C 'suppos':94C 'updat':47B 'use':99C 'version':72C,136C 'view':6A,29B,76C 'view-onc':5A,28B 'write':108C 'yet':123C","nicknames":[],"mitigations":[],"who_affected":"Any team that self-hosts Paaster before 3.3.0 and uses its view-once paste mode is exposed, since one paste can be retrieved by several concurrent requests. Instances that do not use view-once pastes, or that already run 3.3.0 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","paaster","pastebin","selfhosted"],"campaign_type":null,"search_a":"'-2026':11A,14A '-68511':12A,15A 'bypass':4A 'concurr':2A 'cve':10A,13A 'delet':9A 'paaster':1A 'past':8A 'request':3A 'view':6A 'view-onc':5A","search_b":"'atom':50B 'check':44B 'host':21B 'let':35B 'mark':62B 'meant':33B 'mode':31B 'paaster':17B,22B 'parallel':51B 'past':37B,58B 'pastebin':18B,25B 'read':39B,55B,64B 'request':52B 'self':20B 'self-host':19B 'updat':47B 'view':29B 'view-onc':28B","search_c":"'3.3.0':73C,137C 'applic':69C 'atom':111C 'burn':79C 'burn-after-read':78C 'bypass':86C 'check':91C 'concurr':88C 'enforc':96C 'follow':104C 'issu':131C 'mode':83C 'multipl':113C 'paaster':65C,74C 'past':82C,120C 'pastebin':68C 'patch':134C 'plain':102C 'prior':70C 'read':81C,103C,124C 'request':89C,115C 'retriev':128C 'see':118C 'separ':107C 'simultan':114C 'singl':98C 'single-us':97C 'success':127C 'suppos':94C 'use':99C 'version':72C,136C 'view':76C 'write':108C 'yet':123C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T14:41:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68511","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68511","severity":null,"published_at":"2026-11-11T22:17:30+00:00","modified_at":"2026-11-11T22:17:30+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","fetched_at":"2026-11-11T22:29:35+00:00","note":null}],"documents":[{"id":129464,"url":"https://github.com/WardPearce/paaster/releases/tag/v3.3.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129465,"url":"https://github.com/WardPearce/paaster/security/advisories/GHSA-xh42-5mjw-2f4v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T14:41:28+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}