CVE-2026-39924

Katalog CVE

CVSS 6.8 · Medium EPSS 0,37%

Kerentanan Insufficient Session Expiration. Skor CVSS 3.1 6.8 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Flarum before 1.8.16 contains an improper session invalidation vulnerability that allows attackers who hold a valid session token to retain full account access after a victim changes their password, because the access_tokens table is never cleared on password change events. The TokensClearer::clearPasswordTokens() function only removes rows from the password_tokens table while leaving all active session cookies and API bearer tokens intact, including long-lived RememberAccessToken entries, and administrator-forced password resets via the user update endpoint are equally ineffective at revoking attacker-held sessions.

Rincian

Terbit di NVD

5 Agustus 2026

Terakhir diubah

9 September 2026

Status NVD

Deferred

CVSS 3.1

6.8 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/flarum/framework/commit/5f080293a029d0d273eb9678d597c74ea86a3bcc
• https://github.com/flarum/framework/pull/4546
• https://github.com/flarum/framework/releases/tag/v1.8.16
• https://www.vulncheck.com/advisories/flarum-session-persistence-via-improper-access-token-revocation