A vulnerability in cjbi admin3 allows authenticated users to harvest session tokens from audit logs, leading to full unauthorized access and privilege escalation.

The application incorrectly persists sensitive user session tokens within the audit log event body during UserLoggedIn events. Any authenticated user holding the log:view permission can retrieve these tokens via the GET /logs endpoint and replay them to impersonate other users, including administrators.

This vulnerability poses a critical threat to organizational security by enabling trivial account takeover and lateral movement. Because an attacker can masquerade as any user, including those with elevated privileges, they can gain full control over the application environment. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to widespread data compromise, unauthorized administrative changes, and complete loss of system integrity.

Immediate Action: Update to the latest version of admin3 as provided by the vendor, which addresses the improper logging of sensitive credentials.

Proactive Monitoring: Audit logs should be reviewed for anomalous access patterns, specifically focusing on users who are frequently accessing the /logs endpoint or performing administrative actions outside of their established baseline.

Compensating Controls: Restrict the log:view permission to the minimum number of users necessary, or implement a Web Application Firewall (WAF) rule to block or inspect requests to the /logs endpoint for patterns containing session tokens.

Public Exploit Available: Yes, a functional proof-of-concept script exists in the referenced GitHub security research repository.

The ability for a low-privileged user to escalate their access to administrative levels via simple log analysis presents an unacceptable risk. Organizations must prioritize the application of the vendor-supplied patch to sanitize audit logs and prevent the persistence of sensitive session data. Until patching is completed, immediate administrative review of user permissions is required to limit the scope of potential exploitation.