CVE-2026-14227

The record

An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.

Affected packages

Related vulnerabilities

• CVE-2026-63400 Coop is an open source review and moderation tool from ROOST. CWE-613
• CVE-2026-116251 pgAdmin 4 did not invalidate a user's existing sessions when their password changed… CWE-613
• CVE-2026-119577 ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows… CWE-613
• CVE-2026-118665 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. CWE-613
• CVE-2026-6647 In deployments of WSO2 Identity Server configured with a case-insensitive user store and… CWE-613
• CVE-2026-3583 When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection… CWE-613
• CVE-2026-117499 @fastify/session is a session plugin for Fastify. CWE-613
• CVE-2026-116894 REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that… CWE-613