CVE-2026-28660: Security vulnerability
Published Sep 8, 2026
·Updated
In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
Event History
Sep 8, 2026
CVE Published
via MITRE·06:05 PM
Data Sourced
via MITRE·06:05 PM
DescriptionWeakness
Frequently Asked Questions
1
What access does an attacker need before exploiting this issue?
The issue is described as locally exploitable and does not require additional execution privileges. No user interaction is required.
2
What is the documented impact of successful exploitation?
Successful exploitation could disclose local information through a confused-deputy condition in getAllSessions.
3
Are affected versions, specific files, or temporary mitigations identified?
No affected versions, named files, or workaround guidance is provided in the available data.