QuickCMS CVE-2026-33384

Q: What is the CVSS score of CVE-2026-33384?

CVE-2026-33384 has a CVSS 4.0 base score of 4.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33338 MEDIUM

Session Fixation (CWE-384)

2026-05-29 cvd@cert.pl

GHSA-x6p9-8crm-x3hf

Information Disclosure Session Fixation

4.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 16:53 vuln.today

DescriptionCVE.org

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.

AnalysisAI

Session fixation in QuickCMS (OpenSolution) allows an attacker to pre-set a victim's session identifier before the victim authenticates, and because the application fails to regenerate the session ID upon login, the attacker can subsequently hijack the fully authenticated session. All QuickCMS 6.8 deployments lacking the patch published on 2026-05-15 are vulnerable. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the attack requires no attacker privileges and only passive user interaction, making targeted abuse realistic wherever attacker session pre-positioning is feasible.

Technical ContextAI

CWE-384 (Session Fixation) describes a failure to regenerate session identifiers upon privilege escalation - specifically, at the authentication boundary. QuickCMS, a CMS product by OpenSolution, accepts an externally suppliable session identifier prior to login and retains that same token after the user successfully authenticates. This violates the fundamental session lifecycle contract: a new, cryptographically fresh session ID should be issued at every privilege elevation event. No CPE strings were provided in source data; the affected product is OpenSolution QuickCMS 6.8 (unpatched builds prior to the 2026-05-15 fix). The CVSS 4.0 vector assigns AV:L (Local), which in CVSS 4.0 terminology means the vulnerable component is accessed in a local context, a designation that is atypical for classic session fixation and warrants verification against the CERT.pl advisory.

RemediationAI

Apply the patch released for QuickCMS 6.8 on 2026-05-15, available through OpenSolution at https://opensolution.org/home.html and documented in the CERT.pl advisory at https://cert.pl/posts/2026/05/CVE-2026-33384/. The fix corrects the session lifecycle so that a new session identifier is issued upon successful authentication, invalidating any pre-authentication token. The patch version confirmed is QuickCMS 6.8 with the 2026-05-15 update applied; an independently verified downstream release tag was not available in source data. If immediate patching is not feasible, administrators should enforce short session timeouts to minimize the window between session fixation and hijack, and audit any reverse proxy or WAF configuration for mechanisms that might accept or forward externally supplied session cookie values. Restricting access to the login endpoint to trusted network ranges reduces the population of potential attackers who can pre-position a session ID, though this trade-off impacts legitimate remote users.