---
id: "CVE-2026-77171"
kind: "vulnerability"
aliases: ["CVE-2026-77171"]
title: "Public shared collective let link recipients create pages"
severity: "low"
cvss: 3.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "shared-collectives"]
not_affected_if: []
published_at: "2026-10-27T17:17:02+00:00"
first_seen_at: "2026-10-27T17:32:46+00:00"
updated_at: "2026-10-27T17:34:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77171", "first_seen_at": "2026-10-27T17:32:46+00:00"}]
---

# Public shared collective let link recipients create pages

A public shared collective always allowed anyone holding the link to create pages in it. The sources do not name the product, so an attacker with the link can add content they should not be able to write.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-27T17:32:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77171

## From the sources

A public shared collective always allowed recipients of the link to create pages.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_