Inadequate access control in Sesame Time session management
The following endpoints of the Sesame Time web application are affected:
- api/v3/security/login (USID creation);
- /api/v3/security/me (data exposure based on USID);
- other private endpoints such as /private/notification/v1/ (which accept USIDs).
INCIBE has coordinated the publication of a high-severity vulnerability affecting the Sesame Time web application, a human resources management and time and attendance software. The vulnerability was discovered by Miguel Jiménez Cámara.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector and CWE vulnerability type:
- CVE-2026-15389: CVSS v4.0: 8.7 | CVSS AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CWE-639
The vulnerability has been fixed by the Sesame Time team in the latest available version.
The update includes improvements to the authentication mechanism and strengthens authorisation checks on the server to ensure that each session can only access information associated with the authenticated user.
CVE-2026-15389: A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. The flaw lies in the fact that the system uses the session identifier (USID) as the sole validation mechanism, without verifying whether that identifier legitimately belongs to the user making the request. As a result, an attacker who obtains a valid USID can impersonate a victim’s session and access their confidential information, including emails, user IDs, roles and corporate data. This vulnerability is exacerbated by poor session lifecycle management: new logins generate additional USIDs without revoking the previous ones, allowing multiple active sessions to coexist and thereby expanding the attack surface.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-15389 | Alta | No | Sesame |
