CVE-2026-92918 affects admin3 through version 3.0.0. The software persists user session tokens within the audit log event body during UserLoggedIn domain events. An attacker possessing log:view permission can access the GET /logs endpoint, read the JSON response containing these tokens, and replay them as bearer credentials to impersonate users with full access rights. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An attacker with legitimate log:view permissions can harvest session tokens from audit logs and reuse them to fully impersonate users, leading to complete compromise of user accounts and potentially the entire system. This elevates the risk of unauthorized access and data breaches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict log:view permissions to trusted administrators only and monitor access to the GET /logs endpoint to prevent unauthorized token harvesting.