CVE-2026-92920: Cjbi ADMIN3

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request.

Affected products

• Cjbi ADMIN3: up to and including 3.0.0

Published 2026-09-17. Last modified 2026-09-22.