CVE-2026-92918 cjbi CVE debrief

Who should care

Defenders responsible for admin3 deployments, particularly those with log:view permission granted to users or roles, should assess exposure and implement compensating controls to prevent potential full user access through harvested session tokens.

Why it matters

CVE-2026-92918 is a session token disclosure vulnerability in admin3 through version 3.0.0 that allows attackers to harvest session tokens and gain full user access. Defenders should prioritize verifying exposure and implementing compensating controls.

• Potential full user access through harvested session tokens.
• Need to verify exposure and implement compensating controls.
• Possible lateral movement through harvested session tokens.

Technical summary

The vulnerability exists in admin3 through version 3.0.0 and is caused by the persistence of user session tokens in audit log event bodies when publishing UserLoggedIn domain events. Attackers with log:view permission can exploit the vulnerability to harvest session tokens and replay them as bearer credentials for full user access. This allows for potential full user access through harvested session tokens. Defenders should prioritize verifying exposure and implementing compensating controls, such as restricting access to the GET /logs endpoint and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability allows for potential full user access through harvested session tokens.

Recommended defensive actions

• Verify if admin3 version 3.0.0 or earlier is in use and if log:view permission is granted to any users or roles.
• Implement compensating controls, such as restricting access to the GET /logs endpoint and monitoring for suspicious activity.
• Consider upgrading to a version of admin3 that does not persist session tokens in audit logs.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and source references indicate that the vulnerability exists in admin3 through version 3.0.0 and that attackers with log:view permission can exploit the vulnerability to harvest session tokens.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.