PT-2026-30774

Published

2026-03-27

·

Updated

2026-03-27

Description by

CVSS 4.0
7.1
High
MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Summary

Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding.

Details

The HTTP route previously treated any bearer-authenticated request as admin-eligible and could call without binding the action to requester ownership or caller-granted operator scopes. The flaw removes the bearer-token admin fallback and keeps remote session kills on the local-admin or requester-owned path only.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-863: Incorrect Authorization
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
Related identifiers
GHSA-9P93-7J67-5PC2
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com