CVE-2026-126955
Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names.
| CWE | CWE-204 |
| Vendor | glanceapp |
| Product | glance |
| Published | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for glanceapp glance
Be the first to know when new medium vulnerabilities affecting glanceapp glance are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
glanceapp / glance
0.8.0 < 0.8.8
References
github.com: https://github.com/glanceapp/glance/security/advisories/GHSA-294x-cjq2-6j5r github.com: https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244 github.com: https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/glance.go#L306-L316 github.com: https://github.com/glanceapp/glance/releases/tag/v0.8.8 vulncheck.com: https://www.vulncheck.com/advisories/glance-0.8.0-before-0.8.8-page-slug-enumeration-via-response-discrepancy
Credits
Sandipkumar sah Svilen Markov