Medium · 4.1 CVE-2026-92378 EUVD-2026-85153GHSA-hgj5-8xcv-g949

uniFLOW Online Legacy UI Previous login session retained when entering Reduced Function Login

Published Sep 23, 2026 · Updated Sep 23, 2026 · Assigned by Canon_EMEA

Description

A session management
vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware
uniFLOW Online. Under specific timing conditions during Service Offline
Emergency Mode, a previously authenticated session may be retained after
logout, which could allow a subsequent user to be authenticated as the previous
user and gain unauthorised limited access to device functionality.

Affected products

Vendor	Product	Affected	Fixed
NT-ware	uniFLOW Online	≤ 2026.2	—

References

https://www.canon-europe.com/psirt/advisory-information/ vendor-advisory
https://ntware.atlassian.net/wiki/spaces/SA/pages/14160592897/Security+Advisory+Previous+login+session+retained+when+entering+Reduced+Function+Login vendor-advisory mitigation