VulnerabilityDeferred

CVE-2026-34917

An attacker could leverage this to gain unauthorised access and exploit API‑level vulnerabilities.

MEDIUM 4.3EPSS 0.38%

Does this matter?

Lower severity and a low EPSS score (0.38%). Track it; it rarely justifies an emergency change on its own.

Description

Low‑privileged session IDs generated for the web admin console could be reused in the XML‑RPC API, whose authentication is normally restricted to admin users. An attacker could leverage this to gain unauthorised access and exploit API‑level vulnerabilities. The session context (web/API) is now recorded along with other session data, preventing session IDs from being used interchangeably.

CVSS 3.0: 4.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.38% probability · 31th percentile
CISA KEV: Not listed
Weakness: CWE-287
Source: support@hackerone.com

References

https://hackerone.com/reports/3672641

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.