Critical · published November 8, 2021
🔥 Users can remain logged in even after their accounts are disabled — a serious oversight in Apostrophe CMS versions before 3.3.1! Imagine a hotel that forgets to deactivate the room keys of guests who checked out — anyone with a key can waltz right back in. This makes it all too easy for someone with malicious intent to exploit lingering access! If an attacker compromises a device, they can continue to access the victim's account, even if the password is changed or the account is disabled. This security lapse could lead to unauthorized data manipulation, privacy violations, or even a total account takeover — absolutely devastating!
Imagine a hotel that forgets to deactivate the room keys of guests who checked out — anyone with a key can waltz right back in. This makes it all too easy for someone with malicious intent to exploit lingering access! This vulnerability arises because Apostrophe CMS fails to invalidate existing login sessions when a user account is disabled or a password is changed, allowing unauthorized access by previously authenticated devices.
If an attacker compromises a device, they can continue to access the victim's account, even if the password is changed or the account is disabled. This security lapse could lead to unauthorized data manipulation, privacy violations, or even a total account takeover — absolutely devastating! Upgrade to Apostrophe CMS version 3.3.1 or later to seal this loophole. For older releases, consider archiving the user account in version 3.x or moving it to the trash in 2.x and earlier to disable the existing session. Don't wait — secure your application now! You've got this! Follow these steps and keep your users safe. 🛡️