CVE-2026-81826
2026-08-27
17h21 +00:00
17h21 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed.
This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that attacker’s access. The session remains usable until it expires naturally. The upstream commit describes this directly as:
“session keeps working until it expires.”
The fix detects password changes and explicitly invokes _invalidate_user_sessions(user.id) after the database update. This is applied in both edit_user_core() and admin_edit_user_core().
Version impacted >=3.3.0
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Session Fixation Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. |
||
| DEPRECATED: Insufficient Session Expiration This entry has been deprecated because it was insufficiently clear. Consider CWE-1462 and its descendants. |
