CVE-2026-126076

Name of the Vulnerable Software and Affected Versions Action Pack versions prior to 8.1.4.1 Action Pack versions prior to 8.0.5.2

Description Action Pack is a framework for handling and responding to web requests. A flaw exists in ActionDispatch::Session::CacheStore where the session is written back to the cache at the end of each request that loaded it, without verifying if the session's cache entry still exists. If a concurrent request destroys the session—such as during a logout via reset session() or by deleting the cache entry on the server—a request that loaded the session earlier and finishes later may restore it using the original session ID. This can cause logout and server-side revocation to fail, allowing an attacker with a stolen session cookie to maintain access. This issue affects applications using config.session store :cache store with any cache backend. ActionDispatch::Session::CookieStore and ActionDispatch::Session::MemCacheStore using Dalli 4.0.0 or later are not affected.

Recommendations Update Action Pack to version 8.1.4.1 or later. Update Action Pack to version 8.0.5.2 or later.