CVE-2026-92918
HighCVSS 8.8Summary
The admin3 application through version 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.
Risk Assessment
An attacker with log:view permission can hijack other users' sessions, including administrators, gaining full access to their accounts. This leads to privilege escalation and potential compromise of the entire system.
Recommendation
Update the admin3 application to a version newer than 3.0.0. Remove session tokens from audit logs and restrict log:view permission to trusted users.
Other vulnerabilities in admin3
See all- CVE-2026-92921Medium
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort.
- CVE-2026-92920Medium
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.
- CVE-2026-92919High
The admin3 application through version 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process.
Original NVD description (English source)
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.