What is the CVSS score of CVE-2026-27933?

CVE-2026-27933 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Manyfold are affected by CVE-2026-27933?

Organizations using proxy caches. should be aware of notable risk from CVE-2026-27933 rated CVSS 6.8. Exploitation could compromise the security of affected deployments.

Is there a public PoC exploit available for CVE-2026-27933?

Yes, a public proof-of-concept exploit is available for CVE-2026-27933. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27933?

Within 30 days: Identify affected systems running proxy caches. and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Manyfold CVE-2026-27933

MEDIUM

Insufficient Session Expiration (CWE-613)

2026-02-26 security-advisories@github.com

Information Disclosure Manyfold

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 27, 2026 - 17:27 vuln.today

Public exploit code

CVE Published

Feb 26, 2026 - 00:16 nvd

MEDIUM 6.8

DescriptionGitHub Advisory

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Versions prior to 0.133.0 are vulnerable to session hijack via cookie leakage in proxy caches. Version 0.133.0 fixes the issue.

AnalysisAI

Session hijacking in Manyfold prior to version 0.133.0 allows unauthenticated attackers to steal user session cookies through proxy cache leakage, potentially gaining unauthorized access to self-hosted 3D model collections. Public exploit code exists for this vulnerability, and no patch is currently available for affected versions. This attack requires user interaction and can result in complete account compromise without data modification capabilities.

Technical ContextAI

Classified as CWE-613 (Insufficient Session Expiration). Affects Manyfold. Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Versions prior to 0.133.0 are vulnerable to session hijack via cookie leakage in proxy caches. Version 0.133.0 fixes the issue.