PT-2026-52625 · Cacti · Cacti

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-40082

NVD

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session regenerate id() after login, leading to Session Fixation. session regenerate id() is NOT called after successful login. The login flow at auth login.php:203-207 directly sets $ SESSION[SESS USER ID] without rotating the session ID. The session cookie configuration is otherwise good (httponly=true, samesite=Strict, secure=true for HTTPS at include/global.php:513-537), but these do not prevent session fixation via same-site vectors. This issue has been fixed in version 1.2.31.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2026-40082

Affected Products

Cacti

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-40082 · Security Note
• https://github.com/Cacti/cacti/commit/2fa404e70a5702be10682555911228e8e51ba198 · Note
• https://github.com/Cacti/cacti/security/advisories/GHSA-273r-qr93-wgcp · Note
• https://github.com/Cacti/cacti/releases/tag/release%2F1.2.31 · Note