An API session‑management flaw in MikroTik RouterOS allows active sessions to retain old permissions after the session times out or after a user’s group permissions are changed. The flaw falls under CWE‑613. Based on the description, it is inferred that an authenticated user with reduced privileges can still perform unauthorized actions, potentially exposing sensitive data.

The vulnerability affects MikroTik RouterOS products that have the API enabled, across all currently supported versions. No specific product or version sub‑range is listed, so all installations that expose the API are potentially impacted.

The CVSS score of 6.9 indicates a medium‑to‑high risk, while the EPSS score of < 1% suggests the likelihood of exploitation is low. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is inferred to require authenticated access, either through the open API or local administrator privileges. Based on the description, it is inferred that the attacker would need to be already authenticated to exploit the flaw. Once a session survives a permission downgrade, the user could perform actions beyond their new authorization level. There are no publicly known exploits, so the risk is largely theoretical at this time.