{"id":"CVE-2026-129173","kind":"vulnerability","aliases":["CVE-2026-129173"],"related":[],"title":"Stirling-PDF: participant details endpoint has insufficient session timeout","description":"A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantController.getParticipantDetails of the file app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowParticipantController.java of the component Participant Details Endpoint. Performing a manipulation results in insufficient session timeout value. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Stirling-PDF up to 3.3.0 has a flaw in its workflow participant details endpoint where the session timeout is too long. An attacker who gets hold of a session may be able to keep using it longer than intended.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","self-hosted","stirling-pdf"],"not_affected_if":["default-config"],"how_to_check":"- Check the Stirling-PDF version in use; versions up to and including `3.3.0` are listed as affected.\n- Confirm whether the workflow feature (WorkflowParticipantController) is deployed and reachable from the network.","fix":null,"status":"open","published_at":"2026-11-13T23:17:18+00:00","first_seen_at":"2026-11-13T23:35:10+00:00","triaged_at":"2026-11-13T23:37:04+00:00","updated_at":"2026-11-13T23:37:04+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-13T23:37:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Stirling-PDF: participant details endpoint has insufficient session timeout","impact":"low","summary":"Stirling-PDF up to 3.3.0 has a flaw in its workflow participant details endpoint where the session timeout is too long. An attacker who gets hold of a session may be able to keep using it longer than intended.","audience":"businesses","category":"package","nicknames":[],"who_cares":["stirling-pdf","self-hosted","java"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Session stays valid longer than intended, enabling unauthorized access to participant details.","analyst_note":"Check the NVD entry and the Stirling-PDF repository for a fixed version and whether the workflow module is enabled by default.","how_to_check":"- Check the Stirling-PDF version in use; versions up to and including `3.3.0` are listed as affected.\n- Confirm whether the workflow feature (WorkflowParticipantController) is deployed and reachable from the network.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams that self-host Stirling-PDF up to version 3.3.0 with the proprietary workflow module exposed to users. The flaw sits in the participant details endpoint, so deployments without that workflow feature are less likely to be exposed. The sources do not say whether a fix exists.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4631,"output_tokens":536,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129173':13A,16A '-2026':12A,15A '3.3.0':30B,80C 'abl':57B 'affect':81C 'app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/workflowparticipantcontroller.java':89C 'attack':48B,109C 'compon':92C 'contact':115C 'cve':11A,14A 'detail':5A,38B,94C 'disclosur':119C 'discov':70C 'earli':116C 'endpoint':6A,39B,95C 'exploit':106C 'file':88C 'flaw':33B,67C 'function':84C 'get':50B 'hold':51B 'host':21B 'insuffici':8A,101C 'intend':64B 'java':17B 'keep':59B 'long':46B 'longer':62B 'manipul':98C 'may':55B 'packag':18B 'particip':4A,37B,93C 'pdf':3A,24B,27B,77C 'perform':96C 'possibl':111C 'remot':105C 'respond':123C 'result':99C 'secur':66C 'self':20B 'self-host':19B 'session':9A,42B,54B,102C 'stirl':2A,23B,26B,73C,76C 'stirling-pdf':1A,22B,25B,75C 'stirling-tool':72C 'timeout':10A,43B,103C 'tool':74C 'use':60B 'valu':104C 'vendor':113C 'way':126C 'workflow':36B 'workflowparticipantcontroller.getparticipantdetails':85C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Stirling-PDF up to version 3.3.0 with the proprietary workflow module exposed to users. The flaw sits in the participant details endpoint, so deployments without that workflow feature are less likely to be exposed. The sources do not say whether a fix exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","medium","package","selfhosted","stirlingpdf"],"campaign_type":null,"search_a":"'-129173':13A,16A '-2026':12A,15A 'cve':11A,14A 'detail':5A 'endpoint':6A 'insuffici':8A 'particip':4A 'pdf':3A 'session':9A 'stirl':2A 'stirling-pdf':1A 'timeout':10A","search_b":"'3.3.0':30B 'abl':57B 'attack':48B 'detail':38B 'endpoint':39B 'flaw':33B 'get':50B 'hold':51B 'host':21B 'intend':64B 'java':17B 'keep':59B 'long':46B 'longer':62B 'may':55B 'packag':18B 'particip':37B 'pdf':24B,27B 'self':20B 'self-host':19B 'session':42B,54B 'stirl':23B,26B 'stirling-pdf':22B,25B 'timeout':43B 'use':60B 'workflow':36B","search_c":"'3.3.0':80C 'affect':81C 'app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/workflowparticipantcontroller.java':89C 'attack':109C 'compon':92C 'contact':115C 'detail':94C 'disclosur':119C 'discov':70C 'earli':116C 'endpoint':95C 'exploit':106C 'file':88C 'flaw':67C 'function':84C 'insuffici':101C 'manipul':98C 'particip':93C 'pdf':77C 'perform':96C 'possibl':111C 'remot':105C 'respond':123C 'result':99C 'secur':66C 'session':102C 'stirl':73C,76C 'stirling-pdf':75C 'stirling-tool':72C 'timeout':103C 'tool':74C 'valu':104C 'vendor':113C 'way':126C 'workflowparticipantcontroller.getparticipantdetails':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T23:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129173","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129173","severity":null,"published_at":"2026-11-13T23:17:18+00:00","modified_at":"2026-11-13T23:17:19+00:00","first_seen_at":"2026-11-13T23:35:10+00:00","fetched_at":"2026-11-13T23:35:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}