CVE-2026-33284: Globaleaks

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches the issue.

Affected products

• Globaleaks Globaleaks: before 5.0.89 (fixed in 5.0.89)

Published 2026-03-27. Last modified 2026-06-17.