Executive brief
FeehiCMS, a content management system, contains a security flaw in how it handles user logouts. When a user logs out, the system fails to properly deactivate their session on the server, allowing the session to remain valid. If an attacker obtains a user's session cookies, they can reuse them to hijack the account and gain unauthorized access to the website's management features even after the original user thought they had securely signed out.
Technical details
A session invalidation vulnerability (CWE-613) exists in FeehiCMS v.2.1.1. The application's logout handler fails to destroy or invalidate the PHPSESSID and identity cookies on the server-side upon a logout request. An attacker who captures these session identifiers—via network interception, local access, or other means—can reuse them to bypass authentication and maintain access to the victim's account. This allows for persistent unauthorized access and privilege escalation if an administrative session is captured.
Affected products
- FeehiCMS FeehiCMS 2.1.1
Timeline
- 2026-07-31: disclosed: Initial disclosure and CVE assignment
- 2026-07-31: advisory: NVD publication date