What’s Vulnerable › Vulnerabilities

CVE-2026-28275: Initiative Vulnerable to Improper Session Invalidation (JWT Remains Valid)

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-02-26 · updated 2026-06-17
• Weakness: CWE-613

Description

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoints. This behavior allows continued authenticated access even after the account password has been updated. Version 0.32.4 fixes the issue.

Affected products

• Morelitea initiative: before 0.32.4 — fixed in 0.32.4

How to fix

Upgrade to a fixed version: Morelitea initiative 0.32.4. Check the vendor advisory for mitigations.

References

• https://github.com/Morelitea/initiative/releases/tag/v0.32.4
• https://github.com/Morelitea/initiative/security/advisories/GHSA-hww6-3fww-xw3h

Get alerted when CVE-2026-28275 or the next vulnerability affects your stack