SecureDrop Server EUVD-2026-114255

Exploitation is strongly gated and requires the attacker to simultaneously possess three specific prerequisites named in the advisory: (1) access to the secret Journalist Interface (JI) Tor onion address, (2) the required authentication access to that interface, and (3) a recent, non-expired API session token. The underlying flaw is the SessionInterface's mutable session-key prefix (the API vs web prefix state persists across requests), present only in SecureDrop Server versions 2.5.0 through 2.15.x where API and web sessions were split in Redis. The reuse window is bounded to the API token's natural expiry of at most eight hours, and the corrupted prefix may also prevent logout from deleting the correct Redis session (though normal expiry still applies). Limiting factors: this is not remote-unauthenticated - it requires high privilege (PR:H) and significant prior compromise of the journalist/server, which is why the vendor rates complexity High; versions outside the 2.5.0-2.15.x range and patched 2.16.0 installs are not affected. Impact is limited to encrypted submissions (no plaintext exposure) and does not affect availability.

This is a genuinely medium/low-priority issue, not a high-CVSS scare. The CVSS 3.1 base score is 5.0 (AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N), and every severity-raising signal is offset by a strong precondition: although the attack vector is Network (reachable over the Journalist Interface Tor hidden service), Attack Complexity is High and Privileges Required is High because the attacker must already hold the secret JI onion address, valid authentication access, AND a recent non-expired API session token. The GHSA advisory explicitly states the maintainers are not aware of any exploitation in the wild and that significant prior compromise is required. No EPSS score, no CISA KEV listing, and no public exploit code were provided in the input, so there is no signal of widespread or automated exploitation; exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with a real-but-gated issue: worth patching on a normal cycle rather than an emergency. The main caveat is that the integrity impact is High (a compromised journalist session grants broad action over source submissions), so for an organization whose JI is already partially compromised the residual risk is meaningful - but the chain of preconditions makes mass exploitation implausible.

An adversary who has already compromised a journalist to the point of obtaining the secret Journalist Interface onion address, authentication access, and a currently valid API session token replays that API token against the web UI, where the mutable, cross-request session-key-prefix state in the SessionInterface lets Redis treat the API session as a valid web session until it naturally expires (at most eight hours). No public exploit code was identified in the input; the references are the vendor advisory, fix commit, and release, not weaponized PoC code. The attacker then performs broad actions on source submissions and can access encrypted (not plaintext) submissions through the web UI.