CVE-2026-50000

Name of the Vulnerable Software and Affected Versions SecureDrop versions 2.5.0 through 2.15.0

Description The Journalist Interface allows the use of an API session token against the web UI due to the SessionInterface maintaining a mutable session key prefix that changes and persists across requests. This prefix corruption causes confusion between session namespaces in Redis. An attacker with access to the secret Journalist Interface onion address, necessary authentication, and a valid API session token can reuse that token to access the web UI for up to eight hours. Additionally, the corrupted prefix may prevent the logout process from deleting the correct Redis session. A compromised journalist account could be used to access encrypted submissions and perform broad actions on source submissions, though plaintext submissions remain protected and system availability is not impacted.

Recommendations Update to version 2.16.0.