Junglewise Threat Intelligence

CVE-2026-56355: GNU Savannah Savane Incorrect Authorization in file.php

CVE-2026-56355 · Severity: low · CVSS 3.7 · Published 2026-06-20

Executive brief

GNU Savannah Savane, a software suite used to manage web-based hosting for free software projects, contains a security flaw in its authorization logic. An attacker could potentially bypass certain access controls to view information they are not authorized to see. While the impact is limited to low-level data exposure, it represents a failure in how the system verifies user permissions for private items.

Technical details

GNU Savannah Savane through 3.17 is vulnerable to an incorrect behavior order (CWE-696) within its authorization logic. Specifically, the 'file.php' component utilizes untrusted request data ('file_uid') to perform authorization checks via the 'assert_file_access' function. Because the system may rely on user-supplied identifiers rather than strictly validated session data to determine if a user has administrative or group-member privileges, an attacker might gain unauthorized read access to metadata or files associated with private tracker items. The attack requires high complexity as it may depend on specific environmental configurations or the ability to spoof identifiers in a way that satisfies the logic in 'file.php'.

Affected products

  • GNU Savannah Administration Savane 3.14 through 3.17

Timeline

  • 2026-06-20: disclosed: CVE published to NVD

References