CloudClassroom-PHP-Project CVE-2026-120340

Exploitation requires the attacker to possess a valid session identifier/cookie for a target account, because the flaw (CWE-613) is that the Global Session Handler does not sufficiently expire or invalidate sessions - the reference describes a session persisting after logout. The CVSS vector lists PR:N/UI:N (no privileges or user interaction at exploit time), but the high attack complexity (AC:H) and the reporter's 'difficult' exploitability rating reflect the practical hurdle of first acquiring a live session token. Impact is limited to low confidentiality (VC:L) with no integrity or availability effect. Limiting factors: obscure deployment footprint, dependence on obtaining a session token, and high complexity.

Signals here point to a low-to-moderate priority issue. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) describes a remote, unauthenticated vector but with high attack complexity, and the base score of 6.3 is driven by a single low confidentiality impact (VC:L) with no integrity or availability impact. The vuln.today decision label is 'this_month' - routine patching priority, not act_now or emergency. No EPSS score and no CISA KEV listing are provided, so there is no evidence of active or widespread exploitation. The only exploit signal is a GitHub advisory reference (E:P, Proof-of-Concept maturity) that is not verified as working exploit code. Taken together, this is a high-CVSS-complexity, low-impact session-management weakness rather than an urgent threat: the network vector is tempered by the explicitly 'difficult' exploitability the reporter assigns, and by the fact that the product is an obscure open-source project. No conflicting signals in the data, but note EPSS/KEV are simply absent rather than confirmed-negative.

An attacker who can obtain or reuse a victim's existing session cookie (for example after the victim logs out on a shared or public machine) leverages the fact that the session is not properly invalidated, and continues to access the victim's authenticated context. A public PoC reference describes a session/cookie logout weakness, but it is not verified as working exploit code, and the high attack complexity means the scenario depends on the attacker first acquiring a valid session token.