Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-44511

Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated. This vulnerability is fixed in 4.20.0 and 5.6.0.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:c48597cfa49eb68a83c3f5a27e21cfc19f38910ef63d54492b284c08f25e6b85
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"koi","vendor":"katalyst","versions":[{"status":"affected","version":"< 4.20.0"},{"status":"affected","version":">= 5.0.0 <= 5.6.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:02bdaaeb37427c9a6ab6118e83a35a05ef57955aefac6ae8394365c606201604 · sha256:8bc5d3e01383802b… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:02bdaaeb37427c9a6ab6118e83a35a05ef57955aefac6ae8394365c606201604 · sha256:8bc5d3e01383802b… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-613","description":"CWE-613: Insufficient Session Expiration","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:02bdaaeb37427c9a6ab6118e83a35a05ef57955aefac6ae8394365c606201604 · sha256:8bc5d3e01383802b… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion
{"name":"https://github.com/katalyst/koi/security/advisories/GHSA-4cx3-3c38-j9vv","tags":["x_refsource_CONFIRM"],"url":"https://github.com/katalyst/koi/security/advisories/GHSA-4cx3-3c38-j9vv"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:02bdaaeb37427c9a6ab6118e83a35a05ef57955aefac6ae8394365c606201604 · sha256:8bc5d3e01383802b… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer