Home

Description

Non-working logout functionality in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password.

PUBLISHED Reserved 2026-02-02 | Published 2026-03-16 | Updated 2026-03-16 | Assigner NCSC-FI




MEDIUM: 6.0CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Problem types

CWE-613 Insufficient session expiration

Product status

Default status
unaffected

Any version before 2.4
affected

2.4 (maven)
unaffected

Credits

Laban Sköllermark at Reversec Sweden AB finder

References

labs.reversec.com/...gout-functionality-in-truesec-lapswebui

cve.org (CVE-2025-15553)

nvd.nist.gov (CVE-2025-15553)

Download JSON