The disclosed flaw permits any authenticated author with at least one submission on a HotCRP site to use the document API to download any attached PDF or file belonging to any other submission. This creates unauthorized disclosure of potentially sensitive research papers, resulting in a confidentiality breach for all participants.

HotCRP 3.1 released by the Kohler group was affected from commit aa20ef288828b04550950cf67c831af8a525f508 up to but not including the fix in commit ceacd5f1476458792c44c6a993670f02c984b4a0. No other HotCRP versions were explicitly mentioned as vulnerable.

The CVSS base score is 6.5, indicating moderate severity, while the EPSS is less than 1%, suggesting a low likelihood of exploitation. The vulnerability was not listed in the CISA KEV catalog. An attacker would need only valid author credentials and the ability to access the HotCRP document API, which allows them to retrieve any submission document regardless of ownership.