QwikSec

Security Database

CVE

CWE

Training

CVE-2026-33284

Published: Mar 27, 2026

Modified: Mar 27, 2026

PUBLISHED

Description

GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaLeaks performs minimal validation on user-submitted support requests. As a result, arbitrary URLs can be included in support emails sent to administrators. Version 5.0.89 patches the issue.

Vendor	Product	Versions
globaleaks	globaleaks-whistleblowing-software	affected `< 5.0.89`

Weaknesses (CWE)

References

https://github.com/globaleaks/globaleaks-whistleblowing-software/security/advisories/GHSA-84wr-q36q-wqhv

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.