Session Management Flaw in SecureDrop Affects Journalist Interface

CVE-2026-50000

What is CVE-2026-50000?

A vulnerability in SecureDrop's Journalist Interface allows an attacker with access to a valid API session token to exploit session key prefix issues, enabling unauthorized actions on encrypted submissions. This arises due to a mutable session key prefix that persists across requests and confuses session namespaces, posing risks even after token expiration. The flaw allows compromised journalists to perform unauthorized actions, although plaintext submissions remain secure. This issue has been addressed in SecureDrop version 2.16.0.

References