CVE-2026-44511

Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated. This vulnerability is fixed in 4.20.0 and 5.6.0.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/katalyst/koi/security/advisories/GHSA-4cx3-3c38-j9vv

Configurations

No configuration.

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Katalyst Koi es un framework para construir funcionalidad de administración de Rails. Antes de 4.20.0 y 5.6.0, las cookies de sesión de administrador no se invalidaban cuando un usuario administrador cerraba sesión. Un atacante con acceso a una cookie de sesión de administrador válida podría seguir accediendo a la funcionalidad de administración después de cerrar sesión, hasta que la cookie expirara o se rotaran los secretos de sesión. Esta vulnerabilidad está corregida en 4.20.0 y 5.6.0.

Information

Published : 2026-05-14 17:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-44511

Mitre link : CVE-2026-44511

CVE.ORG link : CVE-2026-44511

JSON object : View

Products Affected

No product.

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2026-44511", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44511", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T18:33:52.395978Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "katalyst", "product": "koi", "versions": [{"status": "affected", "version": "< 4.20.0"}, {"status": "affected", "version": ">= 5.0.0 <= 5.6.0"}]}]}], "published": "2026-05-14T17:16:22.760", "references": [{"url": "https://github.com/katalyst/koi/security/advisories/GHSA-4cx3-3c38-j9vv", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated. This vulnerability is fixed in 4.20.0 and 5.6.0."}, {"lang": "es", "value": "Katalyst Koi es un framework para construir funcionalidad de administraci\u00f3n de Rails. Antes de 4.20.0 y 5.6.0, las cookies de sesi\u00f3n de administrador no se invalidaban cuando un usuario administrador cerraba sesi\u00f3n. Un atacante con acceso a una cookie de sesi\u00f3n de administrador v\u00e1lida podr\u00eda seguir accediendo a la funcionalidad de administraci\u00f3n despu\u00e9s de cerrar sesi\u00f3n, hasta que la cookie expirara o se rotaran los secretos de sesi\u00f3n. Esta vulnerabilidad est\u00e1 corregida en 4.20.0 y 5.6.0."}], "lastModified": "2026-10-26T00:10:00.150", "sourceIdentifier": "security-advisories@github.com"}