Threat Intelligence Database

CVE-2026-92921 affects admin3 versions up to 3.0.0 by storing passwords using a single-round MD5 hash with only the username as salt and no key derivation function. This weak hashing method allows attackers with database access to recover plaintext passwords via offline dictionary or brute-force attacks due to minimal computational effort required.

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.

CVE-2026-92919 is a path traversal vulnerability in cjbi admin3 versions up to and including 3.0.0. The application fails to properly sanitize filenames supplied by authenticated users during file uploads on Windows systems. This flaw allows attackers to use directory traversal sequences to write files outside the intended storage directory, potentially overwriting arbitrary files accessible by the server process.

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.