CVE-2026-101272 — Incorrect session validation for API-created shredder exports

CVE-2026-101272 is associated with CWE-384 and affects the binding of files generated during a shredding process to the authentication method. The binding does not work correctly, and the same session token is used for all token-based API users. According to the source, the risk is virtually nonexistent because the files are referenced by randomly generated UUIDs and exist for only one day, but the added protection mechanism is rendered useless.