CVE-2026-26336 Hyland Alfresco Improper Authorization Arbitrary File Read
Unauthenticated attackers can read arbitrary files from protected directories via a specific endpoint, exposing sensitive configuration data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-26336?
CVE-2026-26336 is a high-severity missing authorization vulnerability in Hyland Alfresco Community, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hyland Alfresco allows unauthenticated attackers to read arbitrary files from protected directories (like WEB-INF) via the "/share/page/resource/" endpoint, thus leading to the disclosure of sensitive configuration files.
Weakness: CWE-863
Which versions are affected by CVE-2026-26336?
It affects 1 product.
Products include Hyland Alfresco Content Services.
How do I fix CVE-2026-26336?
No fix has been published for CVE-2026-26336 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-26336 being exploited?
There is no known exploitation of CVE-2026-26336 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Hyland Alfresco Community
Sources
Also known as GHSA-j59q-24q8-ggc7.