Live › vulnerability › CVE-2025-0326
Go to dashboardSensitive account changes such as password reset, role change, or sub-organization disablement do not invalidate access tokens already issued to sub-organization users. A previously issued token that has leaked can keep working after the user's access was changed or revoked.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
The sources describe the flaw as a missing token invalidation step in a hosted sub-organization user system, and do not name a product version or a vendor advisory. Teams that rely on sub-organization access tokens and revoke access through administrative actions are the ones to look at. Exposure also requires that a token was actually leaked, so teams with short token lifetimes are less exposed.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions.
The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors.
This page as .md · .json · in your agent: get_signal("CVE-2025-0326")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.