CVE-2026-50000
SecureDrop: API session token reuse against the Journalist Interface web UI
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.
Timeline
ID reserved
By GitHub_M
- 5 months later
· 5 months later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N |
| NVDNVD · Awaiting Analysis | 3.1 | Medium5.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.36% · top 70% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.
Weakness
Affected products
- affected >= 2.5.0, < 2.16.0
References (3)
- https://github.com/freedomofpress/securedrop/security/advisories/GHSA-78xq-8jf3-gpfx (opens in a new tab)x_refsource_CONFIRM
- https://github.com/freedomofpress/securedrop/commit/cbe60cd68b67f44ffdd44c364c71cc71b40acfb5 (opens in a new tab)x_refsource_MISC
- https://github.com/freedomofpress/securedrop/releases/tag/2.16.0 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-50000)Record last updated .