CVE-2026-92414
Description
A flaw was found in jackrabbit-webdav. The WebDAV (Web Distributed Authoring and Versioning) server attaches a cached authenticated session when request header tokens—such as lock, transaction, or subscription identifiers—match, without verifying user credentials. An unauthenticated remote attacker can exploit this flaw to hijack existing user sessions, gaining unauthorized access to view or modify sensitive repository data.
Statement
This vulnerability is rated as Moderate impact for Red Hat products because exploitation requires an active authenticated session and predictable or known transaction or lock tokens to hijack access. In standard deployments, WebDAV endpoints are not exposed by default or operate within protected boundaries, limiting unauthorized remote access. Red Hat Enterprise Linux core packages do not include vulnerable standalone WebDAV server implementations from this library.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | Low | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
