CVE-2026-33284 Details

A vulnerability exists in GlobaLeaks versions prior to 5.0.89, where the /api/support endpoint lacks adequate validation of user-submitted support requests. This flaw enables the inclusion of arbitrary URLs in support emails sent to administrators. Although the vulnerability does not directly impact the GlobaLeaks platform's functionality or security, it poses a low-risk social engineering threat, as administrators may inadvertently click on these links if they are automatically converted to clickable format by certain email clients, such as Gmail or Outlook.

Users can update to GlobaLeaks version 5.0.89 or later, where this vulnerability has been patched. Additionally, administrators can configure their email clients to disable automatic linking of URLs, treat links from untrusted sources with caution, and train staff to be aware of potential phishing risks.