uniFLOW Online EUVD-2026-85153

Exploitation requires all of the following simultaneously: physical access to the affected Canon multifunction device running NT-ware uniFLOW Online (AV:P); the device using the Legacy UI with the Reduced Function Login feature; the device being in Service Offline Emergency Mode; a specific timing window during which a previously authenticated user's session is retained after they log out (AT:P timing race); and the attacker being a subsequent authenticated device user (PR:L) who benefits from the prior user's logout action (UI:P). Limiting factors that sharply reduce real-world risk: no remote vector, dependence on an infrequent emergency/offline operating mode, reliance on a legacy UI feature, and a non-deterministic timing race that cannot be triggered at will. Modern default configurations and normal online operation are not exposed.

This is a genuinely low-priority issue despite the CWE-613 session-management label. The vendor CVSS 4.0 vector (4.1) is the only quantitative signal and it is internally consistent with a low-severity, physically-gated flaw: AV:P means the attacker must be standing at the affected Canon multifunction device, AT:P and AC:L describe a race/timing window that cannot be triggered on demand, PR:L means the attacker is already an enrolled/authenticated device user, and UI:P means the exploit depends on the prior user's own logout action. Impact is narrow - VC:N/VI:H/VA:N indicates no confidentiality or availability loss, only an integrity effect from acting as the previous user with 'limited access to device functionality.' There is no EPSS score, no CISA KEV listing, and no public exploit code, so exploitation status is: no public exploit identified at time of analysis. There is a mild conflict to verify: the input tags this as 'Information Disclosure,' yet the vector sets VC:N (no confidentiality impact) and marks integrity high - the vulnerability is impersonation/session-fixation-like, not data disclosure, so the tag appears mislabeled. The combination of physical presence, a timing race, prior authentication, and reliance on another user's logout makes real-world exploitation opportunistic and non-scalable rather than a broad threat.

At a shared Canon MFP running uniFLOW Online in Service Offline Emergency Mode, an authenticated user finishes a job via the Legacy UI Reduced Function Login and logs out. Within a narrow timing window the next person to walk up to the device finds the prior session still active and is treated as that earlier user, gaining limited unauthorised access to device functions under their identity. No public proof-of-concept exists; exploitation requires physical presence at the device and lucky timing rather than a remotely deliverable exploit.