CVE-2026-78174: CWE-200 in WatchGuard Dimension

This vulnerability involves improper exposure of sensitive session tokens in WatchGuard Dimension's diagnostic logs. Specifically, session identifiers for logged-in users, including Super Administrators, are logged without redaction. A low-privileged Dimension Administrator can retrieve these logs via the web UI and extract a Super Administrator's session token, enabling them to impersonate the Super Administrator and take over their account. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

An attacker with low-privileged Dimension Administrator access can obtain a Super Administrator's session token from diagnostic logs, leading to full account takeover of the Super Administrator. This compromises the highest privilege level in the system, potentially allowing complete control over the WatchGuard Dimension environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Dimension Administrator privileges to trusted personnel only and monitor access to diagnostic logs carefully.