This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-40082 →

DEBIAN-CVE-2026-40082

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leadin...

Original description

The description as published by the source.

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have missing session_regenerate_id() after login, leading to Session Fixation. session_regenerate_id() is NOT called after successful login. The login flow at auth_login.php:203-207 directly sets $_SESSION[SESS_USER_ID] without rotating the session ID. The session cookie configuration is otherwise good (httponly=true, samesite=Strict, secure=true for HTTPS at include/global.php:513-537), but these do not prevent session fixation via same-site vectors. This issue has been fixed in version 1.2.31.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 cacti

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 cacti

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 cacti

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.31+ds1-1"}]}]

References

advisory security-tracker.debian.org