CVE-2026-92920: admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a bearer token that was issued to a user before that account is disabled. They can then continue sending authenticated requests with the token and retain the account's original permissions.
Are users who authenticate after their account is disabled affected?
The issue concerns existing sessions and bearer tokens issued before disablement. The provided information does not establish that new authentication succeeds after an account has been disabled.
Why does disabling the account not end the attacker's access?
The AuthInterceptor does not re-check whether the user is locked when processing requests. Session expiry is also reset on each request, allowing continued use of the pre-disablement token.
How can administrators identify potentially affected access?
Review for bearer tokens or active sessions created before a user account was disabled, especially where requests from those sessions continued after the disablement event. The available information does not provide a separate detection mechanism or indicator.