High severity7.4GHSA Advisory· Published May 14, 2026· Updated May 14, 2026
CVE-2026-44511
CVE-2026-44511
Description
Katalyst Koi is a framework for building Rails admin functionality. Prior to 4.20.0 and 5.6.0, admin session cookies were not invalidated when an admin user logged out. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout, until the cookie expired or session secrets were rotated. This vulnerability is fixed in 4.20.0 and 5.6.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
katalyst-koiRubyGems | < 4.20.0 | 4.20.0 |
katalyst-koiRubyGems | >= 5.0.0, < 5.6.0 | 5.6.0 |
Affected products
2- Range: >= 5.0.0, < 5.6.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-4cx3-3c38-j9vvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-44511ghsaADVISORY
- github.com/katalyst/koi/security/advisories/GHSA-4cx3-3c38-j9vvnvdWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/katalyst-koi/CVE-2026-44511.ymlghsaWEB
- guides.rubyonrails.org/v5.2.0/security.htmlghsaWEB
News mentions
0No linked articles in our index yet.