CVE-2026-40082 Details
Description
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leading to Session Fixation. session_regenerate_id() is NOT called after successful login. The login flow at auth_login.php:203-207 directly sets $_SESSION[SESS_USER_ID] without rotating the session ID. The session cookie configuration is otherwise good (httponly=true, samesite=Strict, secure=true for HTTPS at include/global.php:513-537), but these do not prevent session fixation via same-site vectors. This issue has been fixed in version 1.2.31.
A session fixation vulnerability has been identified in Cacti versions through 1.2.30. The issue arises because the application does not call 'session_regenerate_id()' after a successful login, leaving the session ID unchanged. This flaw allows an attacker to exploit the same-session ID to access the authenticated session. Although the session cookie settings are generally secure, they do not prevent session fixation through same-site vectors.
This vulnerability has been fixed in Cacti version 1.2.31. Users should upgrade to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cacti/cacti/commit/2fa404e70a5702be10682555911228e8e51ba198 | [email protected] | Patch |
| https://github.com/Cacti/cacti/releases/tag/release%2F1.2.31 | [email protected] | ProductRelease Notes |
| https://github.com/Cacti/cacti/security/advisories/GHSA-273r-qr93-wgcp | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-384 | Session Fixation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cacti cacti | < 1.2.31 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |