This vulnerability (CVE-2026-24318) involves the use of persistent cookies containing sensitive information in SAP BusinessObjects Business Intelligence Platform. Due to insecure session management, the application may accept previously issued session tokens after authentication. An unauthenticated attacker who obtains such tokens can reuse them to gain unauthorized access to the victim's session, thereby compromising confidentiality and integrity of session data. The vulnerability affects specified versions of the platform and has a CVSS 3.1 base score of 4.2 (medium severity). No vendor-provided patch or remediation details are currently available, and the product is not a cloud service.

An attacker exploiting this vulnerability could gain unauthorized access to a victim's authenticated session by reusing valid session tokens. This could lead to unauthorized disclosure and modification of information within the victim's session context. The impact is limited to confidentiality and integrity; availability is not affected. There are no known exploits in the wild, and the vulnerability requires user interaction (UI:R) and high attack complexity (AC:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider monitoring for unusual session token reuse and review session management configurations to reduce risk. No vendor advisory or official remediation instructions have been provided at this time.