Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin passwords.
CVSS 4.0MEDIUM 6.0·Local·Low privileges·User interaction·EPSS 0.00154·Published 2026-03-16·Fixed in 2.4CWE-525
Non-working logout functionality in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password.
CVSS 4.0MEDIUM 6.0·Local·Low privileges·User interaction·EPSS 0.00114·Published 2026-03-16·Fixed in 2.4CWE-613
Insufficient Session Expiration in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin password.
CVSS 4.0MEDIUM 6.0·Local·Low privileges·User interaction·EPSS 0.00115·Published 2026-03-16·Fixed in 2.4CWE-613
THREATIST.IORead the docs