Vulnerability Description
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C06_account_loc
- https://github.com/cjbi/admin3
- https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetec
- https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetec
- https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wetec
- https://www.vulncheck.com/advisories/admin3-through-3.0.0-session-not-invalidate
FAQ
What is CVE-2026-92920?
CVE-2026-92920 is a vulnerability with a CVSS score of 5.4 (MEDIUM). admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bear...
How severe is CVE-2026-92920?
CVE-2026-92920 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92920?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.