Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for securedrop by freedomofpress

    CVE-2026-50000 (GCVE-0-2026-50000)

    Vulnerability from nvd – Published: 2026-10-30 17:11 – Updated: 2026-10-30 18:35
    VLAI
    Title
    SecureDrop: API session token reuse against the Journalist Interface web UI
    Summary
    SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.
    Severity
    5 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-30 18:25 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7913 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    freedomofpress securedrop Affected: >= 2.5.0, < 2.16.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50000",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:25:18.367118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:35:34.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "securedrop",
          "vendor": "freedomofpress",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.5.0, \u003c 2.16.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system\u0027s availability. This issue is fixed in version 2.16.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T17:11:13.250Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/freedomofpress/securedrop/security/advisories/GHSA-78xq-8jf3-gpfx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/freedomofpress/securedrop/security/advisories/GHSA-78xq-8jf3-gpfx"
        },
        {
          "name": "https://github.com/freedomofpress/securedrop/commit/cbe60cd68b67f44ffdd44c364c71cc71b40acfb5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/freedomofpress/securedrop/commit/cbe60cd68b67f44ffdd44c364c71cc71b40acfb5"
        },
        {
          "name": "https://github.com/freedomofpress/securedrop/releases/tag/2.16.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/freedomofpress/securedrop/releases/tag/2.16.0"
        }
      ],
      "source": {
        "advisory": "GHSA-78xq-8jf3-gpfx",
        "discovery": "UNKNOWN"
      },
      "title": "SecureDrop: API session token reuse against the Journalist Interface web UI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50000",
    "datePublished": "2026-10-30T17:11:13.250Z",
    "dateReserved": "2026-06-02T18:30:51.283Z",
    "dateUpdated": "2026-10-30T18:35:34.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-50000 (GCVE-0-2026-50000)

    Vulnerability from cvelistv5 – Published: 2026-10-30 17:11 – Updated: 2026-10-30 18:35
    VLAI
    Title
    SecureDrop: API session token reuse against the Journalist Interface web UI
    Summary
    SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.
    Severity
    5 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-10-30 18:25 UTC
    CWE
    • CWE-863 - Incorrect Authorization
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7913 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    freedomofpress securedrop Affected: >= 2.5.0, < 2.16.0
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50000",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T18:25:18.367118Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T18:35:34.990Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "securedrop",
          "vendor": "freedomofpress",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.5.0, \u003c 2.16.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system\u0027s availability. This issue is fixed in version 2.16.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T17:11:13.250Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/freedomofpress/securedrop/security/advisories/GHSA-78xq-8jf3-gpfx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/freedomofpress/securedrop/security/advisories/GHSA-78xq-8jf3-gpfx"
        },
        {
          "name": "https://github.com/freedomofpress/securedrop/commit/cbe60cd68b67f44ffdd44c364c71cc71b40acfb5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/freedomofpress/securedrop/commit/cbe60cd68b67f44ffdd44c364c71cc71b40acfb5"
        },
        {
          "name": "https://github.com/freedomofpress/securedrop/releases/tag/2.16.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/freedomofpress/securedrop/releases/tag/2.16.0"
        }
      ],
      "source": {
        "advisory": "GHSA-78xq-8jf3-gpfx",
        "discovery": "UNKNOWN"
      },
      "title": "SecureDrop: API session token reuse against the Journalist Interface web UI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50000",
    "datePublished": "2026-10-30T17:11:13.250Z",
    "dateReserved": "2026-06-02T18:30:51.283Z",
    "dateUpdated": "2026-10-30T18:35:34.990Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}