{"id":"CVE-2026-50000","kind":"vulnerability","aliases":["CVE-2026-50000"],"related":[],"title":"SecureDrop: API session tokens accepted by web UI in Journalist Interface","description":"SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.","summary":"SecureDrop's Journalist Interface stores API and web sessions in Redis with a mutable key prefix, so an API session token can be reused against the web UI until it expires (at most eight hours). An attacker who already holds a compromised journalist's valid, unexpired API token and knows the Journalist Interface onion address can act on source submissions, though plaintext submissions are not exposed.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","redis","securedrop","self-hosted"],"not_affected_if":["version-2.16.0-or-later"],"how_to_check":"- Check the installed SecureDrop version on the Journalist Interface server, and confirm whether it is `2.5.0` through `2.16.0`.\n- Review whether any API session tokens issued to journalists remain valid and were possibly leaked.","fix":"- Upgrade SecureDrop to `2.16.0`.","status":"open","published_at":"2026-10-30T17:17:25+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","triaged_at":"2026-10-30T17:32:18+00:00","updated_at":"2026-10-30T17:32:18+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-30T17:32:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SecureDrop to `2.16.0`.","reach":"internet","title":"SecureDrop: API session tokens accepted by web UI in Journalist Interface","impact":"medium","summary":"SecureDrop's Journalist Interface stores API and web sessions in Redis with a mutable key prefix, so an API session token can be reused against the web UI until it expires (at most eight hours). An attacker who already holds a compromised journalist's valid, unexpired API token and knows the Journalist Interface onion address can act on source submissions, though plaintext submissions are not exposed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["securedrop","self-hosted","redis"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reuses a journalist's API token to act on source submissions","analyst_note":"","how_to_check":"- Check the installed SecureDrop version on the Journalist Interface server, and confirm whether it is `2.5.0` through `2.16.0`.\n- Review whether any API session tokens issued to journalists remain valid and were possibly leaked.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.16.0-or-later"],"who_is_affected":"Media organizations and others running SecureDrop from version 2.5.0 up to 2.16.0 whose Journalist Interface is reachable by journalists. Exposure requires a compromised journalist's unexpired API session token, so instances without journalist API use are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00072,"input_tokens":4369,"output_tokens":567,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-50000':14A,17A '2.16.0':117C,261C '2.5.0':115C,160C 'accept':5A,106C,122C 'access':173C,184C,230C 'across':147C 'act':80B 'action':236C 'address':78B,180C 'affect':249C 'alreadi':62B,171C 'also':212C 'although':221C 'anonym':112C 'api':2A,29B,42B,70B,124C,149C,189C 'appli':225C 'attack':60B,169C 'authent':183C 'avail':254C 'broad':235C 'chang':141C 'communic':110C 'compromis':65B,227C 'confus':164C 'correct':218C 'corrupt':163C,209C 'cve':12A,15A 'delet':216C 'document':107C 'eight':57B,206C 'encrypt':231C 'expir':54B 'expiri':203C,223C 'expos':89B,245C 'fix':258C 'hold':63B 'host':23B 'hour':58B,207C 'interfac':11A,27B,76B,120C,178C 'issu':242C,256C 'journalist':10A,26B,66B,75B,119C,177C,228C 'keep':134C 'key':38B,138C 'know':73B 'logout':214C 'media':100C 'mutabl':37B,136C 'namespac':167C 'natur':202C 'nonexpir':188C 'normal':222C 'onion':77B,179C 'open':94C 'open-sourc':93C 'organ':101C 'perform':234C 'persist':146C 'plaintext':85B,246C 'prefix':39B,139C,162C,210C 'prevent':213C 'recent':187C 'redi':19B,34B,156C,219C 'request':144C,148C 'requir':182C 'reus':47B,193C 'run':251C 'secret':176C 'secur':105C 'securedrop':1A,20B,24B,90C 'self':22B 'self-host':21B 'separ':154C 'session':3A,32B,43B,125C,137C,152C,166C,190C,220C 'sessioninterfac':133C 'sourc':82B,95C,113C,238C 'start':157C 'still':224C 'store':28B 'submiss':83B,86B,97C,232C,239C,247C 'system':98C,252C 'though':84B 'token':4A,44B,71B,126C,191C,195C 'ui':8A,51B,130C,199C 'unexpir':69B 'use':103C 'valid':68B 'version':159C,260C 'web':7A,31B,50B,129C,151C,198C 'whistleblow':96C","nicknames":[],"mitigations":[],"who_affected":"Media organizations and others running SecureDrop from version 2.5.0 up to 2.16.0 whose Journalist Interface is reachable by journalists. Exposure requires a compromised journalist's unexpired API session token, so instances without journalist API use are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T17:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-50000","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50000","severity":null,"published_at":"2026-10-30T17:17:25+00:00","modified_at":"2026-10-30T17:17:25+00:00","first_seen_at":"2026-10-30T17:31:39+00:00","fetched_at":"2026-10-30T17:31:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}