CVE-2026-33384

MediumCVSS 4.8/10Last modified Jul 21, 2026

Description

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.

Metrics

CVSS 4.0 4.8/10CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2026
Last modified
Jul 21, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-333855.1A Blind SQL injection vulnerability has been identified in Quick.CMS. Improper neutralization of input provided by a high-privileged user inCVE-2026-333862.3QuickCMS is vulnerable to Cross-Site Scripting (XSS) through its insecure HTTP-based plugin‑fetching mechanism. A malicious attacker can perCVE-2026-333874.6A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An autheCVE-2026-333887.4An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. ACVE-2026-333897.5An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted conCVE-2026-33392.7The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_CVE-2026-333908.1An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissCVE-2026-333915.4An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user priviCVE-2026-333927.2In JetBrains YouTrack before 2025.3.131383 high privileged user can achieve RCE via sandbox bypassCVE-2026-333934.3Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the `allowed_spam_host_domainsCVE-2026-333942.7Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the Post Edits admin report (/CVE-2026-333955.4Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the discourse-graphviz plugin