{"id":"CVE-2026-77171","kind":"vulnerability","aliases":["CVE-2026-77171"],"related":[],"title":"Public shared collective let link recipients create pages","description":"A public shared collective always allowed recipients of the link to create pages.","summary":"A public shared collective always allowed anyone holding the link to create pages in it. The sources do not name the product, so an attacker with the link can add content they should not be able to write.","severity":"low","cvss":3.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","shared-collectives"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T17:17:02+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:34:59+00:00","updated_at":"2026-10-27T17:34:59+00:00","category":"other","confidence":0.3,"triage":{"at":"2026-10-27T17:34:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Public shared collective let link recipients create pages","impact":"medium","summary":"A public shared collective always allowed anyone holding the link to create pages in it. The sources do not name the product, so an attacker with the link can add content they should not be able to write.","category":"other","nicknames":[],"who_cares":["shared-collectives"],"confidence":0.3,"needs_auth":"no","worst_case":"Anyone with the share link can create pages in the collective","analyst_note":"Identify the product and affected versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-77171 and find the vendor fix.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000477,"input_tokens":3220,"output_tokens":310,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-77171':11A,14A 'abl':54B 'add':48B 'allow':24B,62C 'alway':23B,61C 'anyon':25B 'attack':43B 'collect':3A,18B,22B,60C 'content':49B 'creat':7A,30B,68C 'cve':9A,12A 'hold':26B 'let':4A 'link':5A,28B,46B,66C 'name':38B 'page':8A,31B,69C 'product':40B 'public':1A,20B,58C 'recipi':6A,63C 'share':2A,17B,21B,59C 'shared-collect':16B 'sourc':35B 'write':56B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77171","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77171","severity":null,"published_at":"2026-10-27T17:17:02+00:00","modified_at":"2026-10-27T17:17:02+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}