The vulnerability resides in SecureDrop’s handling of session tokens for the Journalist Interface. The system mistakenly allows an API session token to be used against the web UI because a mutable session‑key prefix can become corrupted, blending API and web session namespaces in Redis. This flag means a compromised journalist or an attacker possessing a valid API token can access submissions and perform broad actions against source entries, though plaintext data and system availability remain protected. The weakness is classified as CWE‑863.

The issue affects SecureDrop versions 2.5.0 through 2.15.3 inclusive. The fix was released in version 2.16.0; any deployment running earlier than or equal to that release is vulnerable.

The CVSS score of 5 indicates a moderate impact. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited yet. Exploitation requires the attacker to already have an authenticated session to the onion address and a non‑expired API token, making it an authenticated privilege escalation rather than a remote, zero‑day attack. The likely vector is the web application, with the victim’s browser session hijacked after login. While the vulnerability does not allow direct access to plaintext submissions or denial of service, it grants an attacker the ability to read and manipulate encrypted data at the journalist level.