Running a CVE Numbering Authority

Running a CNA is less about tooling than discipline.

A finding isn't reported until it has been scoped, scored against a stated rubric, mapped to a weakness chain, written into a valid record, and disclosed on a timeline both sides agreed to. A screenshot in a chat thread is not a report.

I hold my own findings to the same standard.

The record

17 published advisories. 15 CVEs. Three critical.

The highest scored 10.0: arbitrary code execution and token exfiltration through a CI workflow. Next at 9.9: super-admin takeover by forging a JWT in a third-party auth provider path. Then a run of high-severity issues covering stored XSS, unrestricted file upload through MIME type spoofing, and unauthenticated full-read SSRF.

Reading the clusters

Eight of those advisories are server-side request forgery. Webhook creation, RSS fetching, a URL loader, an upload-from-URL endpoint, a public streaming endpoint, a redirect bypass, and a TOCTOU DNS rebinding issue that defeated every URL validation path at once.

That last one is the useful one. When a single finding bypasses every validator you have, the answer is not a better validator. It is that validation was the wrong control for the problem.

A cluster that size says something about the product rather than about the developers. A social scheduler exists to fetch and post things on your behalf. Making outbound requests to attacker-influenced URLs is its job description. Bug classes that come from a product's shape need structural answers.

Payment callbacks are the second cluster: an unauthenticated lifetime PRO grant through a payments webhook, a billing-enforcement bypass, and forgeable lifetime-deal redemption codes. Same lesson, different surface. Anything that grants entitlements from an unauthenticated callback needs to verify rather than trust.

Weakness chains, not weakness labels

Records get CWE chains rather than a single identifier, so the root cause ends on the record instead of only the symptom.

A stored XSS that was reachable because an upload accepted a spoofed MIME type is two weaknesses and one story. Recording only the second means the next person fixes the output encoding and leaves the upload alone.

Scoring

CVSS 3.1 and 4.0, both in active use. The vector and the reasoning get written down, not just the number.

A base score with no vector is an opinion. A vector is something a reader can disagree with specifically, which is the point.

Disclosure

Coordinated, through GHSA. Embargo handling, reporter communication, timed publication.

Records are authored straight against the CVE JSON 5.1 schema, and go out in OSV as well, so the data is usable by whoever needs it rather than only by the platform that hosted it.

My own code gets the same treatment

Contribution Checker has its own published advisories under the GSSA- prefix, written up the same way a third-party finding would be. Missing security response headers. An unbounded request body on the webhook and CI endpoints that let a large post exhaust process memory.

Both fixed, both on record. Publishing findings against your own product is the cheap version of a promise, and it means this page is not the only thing making claims.

Two numbering systems, not one

Postiz is also GCVE Numbering Authority 125, listed in the GNA directory. GCVE is a decentralised allocation system: a GNA assigns identifiers itself, in the form GCVE-125-YYYY-NNNNN, without waiting on a block from a central authority.

It does not replace CVE and is not meant to. Every CVE is already addressable in the GCVE namespace under GNA 0, so CVE-2026-12345 and GCVE-0-2026-12345 are the same record. Running both means the identifier is not a single point of failure, which is a cheap thing to arrange in advance and an expensive one to arrange afterwards.

The allocation, publication and dump endpoints the directory lists for GNA 125 are served by GAdvisory. The registry entry points at software I wrote.

Conformance, published rather than promised

GCVE maintains a set of best current practice documents. BCP-06 covers how a numbering authority governs itself, and GNA 125 publishes a machine-readable self-assessment against it at a fixed URL, currently BCP-06-1.0.

It states the things a reporter would otherwise have to ask for and take on trust: that the disclosure model is coordinated rather than full or none, that embargoes are supported and the embargo policy is public, that every allocation is reviewed by a person rather than issued automatically, and that the first review happens within 7 days. Those are commitments a reader can hold the programme to, because they are fetchable.

BCP-07 covers known-exploited vulnerabilities, and GNA 125 publishes that feed too. It has 0 entries. An empty feed is a real answer and worth publishing as one: nothing this programme has assigned is known to be exploited.

Both files sit next to the allocation and dump endpoints, served by GAdvisory. The record page reads them on a timer, so what this page says about them is what they say about themselves.

Where to send something

Postiz findings go to this programme, by email or through GAdvisory. The contact page has both addresses.

Findings in my own software are a different programme with a different scope and its own response times, set out in the Gelhaus Solutions security policy.

All of it is published through GAdvisory, which is my own platform, running in production at gadvisory.org.