QuickCMS allows a user’s session identifier to be set before authentication. The value of this session ID remains unchanged after the user logs in, enabling an attacker to fix a session ID for a victim and subsequently hijack the authenticated session. This flaw can compromise the confidentiality and integrity of user sessions without providing direct remote code execution or denial of service. The weakness is categorized as CWE-384, Session Fixation.

The vulnerability affects deployments of OpenSolution QuickCMS that have not applied the patch released on 15.05.2026. The patch addresses the flaw in version 6.8, so any instance running a version earlier than 6.8 is considered vulnerable. No further version granularity is provided, so system administrators should verify that QuickCMS is at least 6.8 or later.

With a CVSS score of 4.8, the risk is considered medium. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is web-based; an adversary may set a session ID via a crafted URL or cookie before the victim authenticates. Because session identifiers persist across authentication, the attacker can later use the same ID to impersonate the legitimate user.