CVE-2026-28275highCWE-613

CVE-2026-28275: fallo de gravedad alta en Morelitea initiative

Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear initiative

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.1epss 0.4%
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoints. This behavior allows continued authenticated access even after the account password has been updated. Version 0.32.4 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Productos afectados
Morelitea · initiative
CVEs relacionadas — Morelitea initiative

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-28274HIGHInitiative Vulnerable to Token Theft via Stored XSS in Document UploadsEPSS 0.6%CVE-2026-28276HIGHInitiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ EndpointEPSS 0.4%