CVE-2026-28275highCWE-613

CVE-2026-28275: falha de alta gravidade em Morelitea initiative

Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar initiative

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.4%
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoints. This behavior allows continued authenticated access even after the account password has been updated. Version 0.32.4 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Morelitea · initiative
CVEs relacionadas — Morelitea initiative

No mesmo produto, das mais perigosas para as menos.

CVE-2026-28274HIGHInitiative Vulnerable to Token Theft via Stored XSS in Document UploadsEPSS 0.6%CVE-2026-28276HIGHInitiative Allows Unauthenticated Access to Uploaded Documents via Public /uploads/ EndpointEPSS 0.4%