CVE-2026-32097

CVE-2026-32097 impacts Harvard PingPong versions prior to 7.27.2, enabling authenticated users to retrieve or delete private files outside their authorized scope, including user-uploaded content and model-generated output. This vulnerability carries a CVSS score of 8.8 (High), stemming from a network attack vector with low attack complexity, requiring only low privileges and no user interaction. Its potential impact is high across confidentiality, integrity, and availability. Exploitation necessitates authentication and permission to view or participate in at least one thread. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed on CISA's Known Exploited Vulnerabilities catalog.