Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without …

Serendipity versions before 2.6.1 contain an authentication context confusion vulnerability tracked as CVE-2026-67351. The flaw arises because password validation and session loading operate independently without ensuring they reference the same user record. An authenticated Editor-level user can exploit this by creating a username collision with an Administrator account. Upon login, the system validates the Editor's password but loads the Administrator's session data, effectively granting administrative privileges. This represents a privilege escalation vulnerability requiring only authenticated Editor access. The issue has been patched in Serendipity 2.6.1. Advisories have been published on GitHub Security Advisories and VulnCheck. Organizations running older versions of Serendipity should update immediately to mitigate the risk of unauthorized privilege escalation.