CVE-2026-56355: GNU Savane Auth Bypass Vulnerability

CVE-2026-56355 Overview

CVE-2026-56355 is an authorization weakness in GNU Savannah Administration Savane through version 3.17. The application uses untrusted data as part of its authorization logic, allowing attackers to influence access decisions through attacker-controlled input. The flaw is categorized under CWE-696 (Incorrect Behavior Order). Exploitation occurs over the network without authentication, but requires high attack complexity, limiting practical impact to confidentiality only.

Critical Impact
An unauthenticated remote attacker can manipulate untrusted input used in authorization checks within Savane's PHP frontend, leading to limited disclosure of information that should otherwise be access-restricted.

Affected Products

GNU Savannah Administration Savane through release 3.17
Savane PHP frontend component (frontend/php/file.php)
Self-hosted Savane deployments tracking projects, bugs, and patches

Discovery Timeline

2026-06-20 - CVE-2026-56355 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56355

Vulnerability Analysis

GNU Savane is the PHP-based forge software that powers GNU Savannah, hosting source code, bug trackers, and file releases for GNU projects. The vulnerability resides in the file download handling logic within frontend/php/file.php at lines 113 and 123 of the release-3.17 branch. The code path consumes user-supplied data during the authorization decision rather than relying solely on validated server-side state.

Because authorization depends on input that the requester controls, an attacker can craft a request that causes the application to authorize access to a resource that should be restricted. The flaw is classified under CWE-696, reflecting an incorrect order between data validation and the access control decision.

The attack requires high complexity, indicating that successful exploitation depends on specific conditions in the targeted instance. Impact is limited to low confidentiality loss with no impact to integrity or availability.

Root Cause

The root cause is a Broken Access Control pattern where authorization checks consume untrusted parameters that the attacker submits in the HTTP request. The PHP frontend does not anchor the access decision to a trusted server-side identifier for the requested file. Instead, parts of the request body or query string contribute to the authorization outcome.

Attack Vector

An unauthenticated attacker sends an HTTP request to a Savane instance targeting the file download endpoint. By tampering with request parameters that feed the authorization routine in file.php, the attacker can obtain access to file metadata or content intended to be restricted. See the GNU Savane file.php source at line 113 and line 123 for the affected code paths. Additional context is available in the FSF statement regarding GNU Savannah security reports and the Hacker News discussion.

No public exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data places the probability of exploitation in the next 30 days at 0.349%.

Detection Methods for CVE-2026-56355

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to file.php endpoints with unusual or manipulated query parameters
Successful file download responses for resources associated with private projects or non-public release groups
Spikes in 200-status responses to file.php from single source IPs across many file identifiers

Detection Strategies

Review web server access logs for sequential or enumeration-style access to frontend/php/file.php resources
Correlate file access events against the project's published release visibility to flag access to resources marked private
Apply WAF rules that inspect parameters passed to file.php and block requests lacking expected session context

Monitoring Recommendations

Enable verbose PHP and HTTP access logging on the Savane host and forward logs to a centralized analytics platform
Alert on anomalous request rates against file.php from a single client over short intervals
Monitor outbound transfer volumes from the Savane web server for sustained downloads inconsistent with normal usage

How to Mitigate CVE-2026-56355

Immediate Actions Required

Inventory all internal and public-facing Savane deployments and confirm versions at or below 3.17
Restrict network access to Savane file download endpoints to authenticated sessions where operationally feasible
Audit recent access logs for file.php requests targeting non-public files

Patch Information

At the time of publication, no fixed release has been issued for Savane beyond 3.17. Administrators should track upstream changes in the Savane source repository and apply patches as they become available. Refer to the FSF security statement for vendor positioning on Savannah security reports.

Workarounds

Place Savane behind a reverse proxy that enforces authentication on file.php paths
Add server-side checks that validate the requested file identifier against the authenticated user's project membership before serving content
Temporarily disable anonymous access to file download endpoints in deployments hosting sensitive material

bash

# Example nginx restriction limiting file.php to authenticated sessions
location ~ ^/file\.php$ {
    auth_request /auth/validate;
    error_page 401 = @unauthorized;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}

location @unauthorized {
    return 401;
}