Is CVE-2026-92918 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-92918?

CVE-2026-92918 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-92918

Description

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.