CVE-2026-78174
CriticalCVSS 9.3Summary
Vulnerability in WatchGuard Dimension: web UI diagnostic log stores unredacted session identifiers for logged-in users. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token, enabling account takeover.
Risk Assessment
A low-privileged user can take over a Super Administrator account, leading to full compromise of the management system. High risk for the organization.
Recommendation
Update WatchGuard Dimension to the latest version. Restrict access to diagnostic logs and monitor administrator activity.
Original NVD description (English source)
WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.