This vulnerability arises from a session invalidation flaw in x‑ui 0.3.2. The full user object is stored in a client‑side signed cookie, and authentication only verifies that a cookie can be retrieved without re‑validating against the database or any session version. When an administrator changes the username or password, previously issued session cookies are not revoked, which means an attacker who holds a pre‑change admin cookie can continue accessing and operating the management interface with full administrative privileges after credentials have been rotated.

The flaw is present in x‑ui version 0.3.2, a web‑based user interface tool. No other versions or vendor products are currently reported as affected by this issue.

Because the CVSS score of 4.8 indicates a moderate impact and the EPSS score of <1% suggests low exploitation probability, the likelihood of exploitation is uncertain. However, the flaw permits long‑lived privileged sessions if an attacker can obtain or forge a valid cookie. The missing revocation step is a critical session‑management weakness, making a successful exploit highly valuable for controlling the application without re‑authentication. The vulnerability is not listed in the CISA KEV catalog, so no mandatory mitigation steps are currently mandated.