CVE-2026-44423 is an authorization bypass vulnerability in ShellHub, a centralized SSH gateway. Before version 0.24.2, the API endpoint GET /api/sessions/:uid returns the complete session object for any authenticated user without restricting access to the user's own tenant namespace. This flaw enables an authenticated user to access session records of other tenants, exposing sensitive session metadata. The vulnerability is identified as CWE-639 (Authorization Bypass Through User-Controlled Key) and has a CVSS 3.1 base score of 6.5, indicating medium severity. No official remediation level or patch links are provided in the data, but the description states the issue is fixed in version 0.24.2.

An authenticated user can read sensitive session information from other tenants, including SSH usernames, device unique identifiers, remote IP addresses, terminal types, authentication status, and timestamps. This exposure compromises confidentiality of session data across tenant boundaries but does not affect integrity or availability. There are no known exploits in the wild.

Upgrade ShellHub to version 0.24.2 or later, where this authorization bypass vulnerability has been fixed. Since no official patch links or vendor advisory are provided, verify the upgrade through the vendor's official release notes or repository. Until upgraded, restrict access to trusted users only and monitor for unauthorized access attempts. Patch status is not explicitly confirmed beyond the version fix statement; check vendor sources for current remediation guidance.