---
id: "CVE-2026-68511"
page: "https://infrastack.ai/live/CVE-2026-68511"
kind: "vulnerability"
aliases: ["CVE-2026-68511"]
title: "Paaster: concurrent requests bypass view-once paste deletion"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "paaster", "pastebin", "self-hosted"]
not_affected_if: ["version-3.3.0-or-later", "view-once-unused"]
published_at: "2026-11-11T22:17:30+00:00"
first_seen_at: "2026-11-11T22:29:35+00:00"
updated_at: "2026-11-11T22:34:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68511", "first_seen_at": "2026-11-11T22:29:35+00:00"}]
exploit_sources: []
---

# Paaster: concurrent requests bypass view-once paste deletion

Link for people: https://infrastack.ai/live/CVE-2026-68511 (this .md is for agents)

Paaster is a pastebin, and its view-once mode is meant to let a paste be read only once. Because the check and the update are not atomic, parallel requests can all read the same paste before it is marked as read.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Paaster version; versions below `3.3.0` are affected.
- Confirm whether the instance has view-once (burn-after-reading) pastes enabled.

## Fix

- Paaster: upgrade to `3.3.0` or later.

## Timeline

- 2026-11-11T22:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68511

## Documents

- [advisory] Vendor advisory: github.com https://github.com/WardPearce/paaster/security/advisories/GHSA-xh42-5mjw-2f4v
- [fix] Release notes: github.com https://github.com/WardPearce/paaster/releases/tag/v3.3.0

## From the sources

Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concurrent requests. The check that's supposed to enforce single-use is a plain read followed by a separate write, with no atomicity, so multiple simultaneous requests can all see the paste as "not yet read" and all successfully retrieve it. This issue has been patched in version 3.3.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_