Freedom of the Press Foundation SecureDrop up to 2.15.x Journalist Interface missing encryption

Summaryinfo

A vulnerability, which was classified as problematic, was found in Freedom of the Press Foundation SecureDrop up to 2.15.x. Affected by this vulnerability is an unknown functionality of the component Journalist Interface. Such manipulation leads to missing encryption. This vulnerability is uniquely identified as CVE-2026-50000. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Freedom of the Press Foundation SecureDrop up to 2.15.x and classified as problematic. Affected by this issue is some unknown functionality of the component Journalist Interface. The manipulation with an unknown input leads to a missing encryption vulnerability. Using CWE to declare the problem leads to CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. Impacted is confidentiality. CVE summarizes:

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-50000 since 06/02/2026. The exploitation is known to be difficult. The attack may be launched remotely. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.

Upgrading to version 2.16.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Freedom of the Press Foundation

Name

• SecureDrop

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion