CVE-2026-28812CWE-290

CVE-2026-28812

Critical · published July 30, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.

Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00690 · 52.3th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-07-30T20:17Z
Affected products (1)
ProductVersionsFixed in
apache/jspwiki< 2.12.42.12.4
References (2)
https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p · [email protected]http://www.openwall.com/lists/oss-security/2026/07/30/15 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 30 JUL 15:52Z
    Apache JSPWiki: UserManager does not sanity-check user database at startup
    cvelistv5