CVE-2026-55493

HotCRP is conference review software. Starting with 2.101, the cmt: search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A cmt:USER search can therefore match a paper with a visible comment authored by USER ev...