Action Pack is a framework for handling and responding to web requests.
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, AbstractSecureStore or the session mixins) write the session cookie without a SameSite attribute, regardless of config.action_dispatch.cookies_same_site_protection, which defaults to :lax. Only CookieStore applies the configured policy. In browsers that do not treat a cookie without the attribute as SameSite=Lax, a cross-site request could carry the session cookie, possibly leading to cross-site request forgery against actions that do not verif
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Ruby on Rails
- Product
- rails
- CVSS v3.1
- 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
- Fix
- available
- Weakness
- CWE-352
- NVD status
- Received
Why it ranks 20 (Routine)
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-126067 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.