CVE-2026-92918

Summary

The flaw allows attackers with log:view permission to read session tokens from the audit log, which can be used to gain full user access.

Exploitability

Exploitation requires log:view permission and access to the GET /logs endpoint. The attacker must have read access to the audit logs.

Blast radius

If exploited, the impact is high as it grants full user access to the attacker.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected feature or restrict access to the GET /logs endpoint.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.