CVE-2026-126955

Description

Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names.

References

• https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/glance.go#L306-L316
• https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244
• https://github.com/glanceapp/glance/releases/tag/v0.8.8
• https://github.com/glanceapp/glance/security/advisories/GHSA-294x-cjq2-6j5r
• https://www.vulncheck.com/advisories/glance-0.8.0-before-0.8.8-page-slug-enumeration-via-response-discrepancy