CVE-2026-27933

Published: Feb 26, 2026Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 1.6 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Versions prior to 0.133.0 are vulnerable to session hijack via cookie leakage in proxy caches. Version 0.133.0 fixes the issue.

Affected (1)

Products: Manyfold: Manyfold

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Manyfold Manyfold	Before 0.133.0

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

https://github.com/manyfold3d/manyfold/releases/tag/v0.133.0

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/manyfold3d/manyfold/security/advisories/GHSA-g949-hmvj-2r76

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.