CVE-2026-92920Medium· 5.4▾ TwilightPoC availableadmin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disab…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Exploit / PoC code exists
0.2% → 0.3%
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92919High· 8.1admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments
CVE-2026-92921Medium· 4.9admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function
CVE-2026-92918High· 8.8admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events
CVE-2026-89035High· 7.4MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass
CVE-2026-111917Medium· 6.5Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
CVE-2026-111919Medium· 6.5Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed