CVE-2026-27933

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-27933
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27933.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-27933
Aliases
  • GHSA-g949-hmvj-2r76
Published
2026-02-25T23:16:01Z
Modified
2026-10-21T02:56:35Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Manyfold vulnerable to session hijack via cookie leakage in proxy caches
Details

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Versions prior to 0.133.0 are vulnerable to session hijack via cookie leakage in proxy caches. Version 0.133.0 fixes the issue.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-613"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27933.json"
}
References

Affected packages

Git / github.com/manyfold3d/manyfold

Affected ranges

Type
GIT
Repo
https://github.com/manyfold3d/manyfold
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
572b9ff5760b7bed2d0840a50957a32380af512e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.133.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "original_tag":  "v0.133.0",
            "range":  [
                {
                    "fixed":  "572b9ff5760b7bed2d0840a50957a32380af512e"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "cpe":  "cpe:2.3:a:manyfold:manyfold:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.133.0"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.10.0
v0.10.1
v0.100.0
v0.100.1
v0.101.0
v0.102.0
v0.103.0
v0.103.1
v0.103.2
v0.104.0
v0.104.1
v0.105.0
v0.106.0
v0.107.0
v0.108.0
v0.108.1
v0.109.0
v0.109.1
v0.109.2
v0.11.0
v0.11.1
v0.110.0
v0.110.1
v0.110.2
v0.111.0
v0.111.1
v0.111.2
v0.112.0
v0.113.0
v0.114.0
v0.114.1
v0.115.0
v0.115.1
v0.116.0
v0.116.1
v0.116.2
v0.117.0
v0.118.0
v0.119.0
v0.12.0
v0.12.1
v0.120.0
v0.121.0
v0.122.0
v0.122.1
v0.123.0
v0.123.1
v0.123.2
v0.124.0
v0.125.0
v0.126.0
v0.127.0
v0.128.0
v0.128.1
v0.129.0
v0.129.1
v0.129.2
v0.129.3
v0.129.4
v0.13.0
v0.130.0
v0.130.1
v0.130.2
v0.130.3
v0.130.4
v0.131.0
v0.132.0
v0.132.1
v0.14.0
v0.15.0
v0.16.0
v0.16.1
v0.16.2
v0.17.0
v0.18.0
v0.19.0
v0.2.0
v0.20.0
v0.21.0
v0.21.1
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.25.1
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.3.0
v0.3.0-beta.1
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.33.1
v0.34.0
v0.35.0
v0.36.0
v0.37.0
v0.38.0
v0.39.0
v0.4.0
v0.40.0
v0.41.0
v0.42.0
v0.43.0
v0.44.0
v0.45.0
v0.46.0
v0.47.0
v0.47.1
v0.48.0
v0.49.0
v0.5.0
v0.50.0
v0.51.0
v0.52.0
v0.52.1
v0.53.0
v0.54.0
v0.54.1
v0.54.2
v0.55.0
v0.55.1
v0.55.2
v0.56.0
v0.56.1
v0.57.0
v0.57.1
v0.57.2
v0.58.0
v0.59.0
v0.59.1
v0.6.0
v0.6.1
v0.6.2
v0.60.0
v0.61.0
v0.62.0
v0.63.0
v0.64.0
v0.65.0
v0.66.0
v0.66.1
v0.66.2
v0.67.0
v0.68.0
v0.69.0
v0.7.0
v0.70.0
v0.70.1
v0.70.2
v0.70.3
v0.71.0
v0.72.0
v0.72.1
v0.72.2
v0.73.0
v0.74.0
v0.74.1
v0.74.2
v0.75.0
v0.75.1
v0.76.0
v0.76.1
v0.77.0
v0.77.1
v0.77.2
v0.77.3
v0.78.0
v0.78.1
v0.79.0
v0.8.0
v0.8.1
v0.80.0
v0.80.1
v0.81.0
v0.82.0
v0.82.1
v0.83.0
v0.84.0
v0.84.1
v0.85.0
v0.85.1
v0.86.0
v0.87.0
v0.87.1
v0.88.0
v0.89.0
v0.9.0
v0.90.0
v0.90.1
v0.90.2
v0.91.0
v0.91.1
v0.91.2
v0.91.3
v0.92.0
v0.93.0
v0.94.0
v0.95.0
v0.95.1
v0.96.0
v0.97.0
v0.97.1
v0.98.0
v0.99.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27933.json"