HotCRP Document API Unauthorized Access Vulnerability

A vulnerability in HotCRP's document API allowed authors with submissions to download any documents associated with any submission on the site. This issue was present in HotCRP version 3.1 and was introduced in October 2025. The vulnerability has been patched in version 3.2.

Impact

Exploitation of this vulnerability allowed for unauthorized access to documents submitted by other authors, including PDFs and attachments.

Reproduction

To reproduce this vulnerability, an author with at least one submission on a HotCRP site could use the document API to request documents from any submission, bypassing authorization checks. This could be done by manipulating the API request to include the desired document's submission details.

Remediation

Users can upgrade to HotCRP version 3.2 to address this vulnerability.