A missing tenant scoping check in the GET /api/sessions/:uid endpoint allows an authenticated user to read session records that belong to any other namespace. The exposed data includes SSH usernames, device identifiers, IP addresses, terminal types, authentication status, and timestamps. This information can aid attackers in gathering reconnaissance about other tenants’ environment or facilitate further lateral movement. The weakness is an Insecure Direct Object Reference (CWE‑639).

ShellHub from shellhub‑io is affected. All releases before version 0.24.2 allow this IDOR. The vulnerability was fixed in 0.24.2, so any installation using an earlier version is vulnerable.

The CVSS score of 6.5 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The likely exploit requires an attacker to be logged in to the ShellHub instance and to have at least tenant‑level authentication, so the attack surface is limited to authenticated internal users. However, once access is obtained, the disclosure of detailed session information could be leveraged for further attacks or data exfiltration.