CVE-2026-28814CWE-306

CVE-2026-28814

High · published July 30, 2026

CVSS v3.1

7.5

EPSS

Percentile

50.8

In the wild

Unconfirmed

What it is

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables.

Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00657 · 50.8th percentile
Weakness: CWE-306 · Missing Authentication for Critical Function
Published: 2026-07-30T20:17Z

Affected products (1)

Product	Versions	Fixed in
apache/jspwiki	< 2.12.4	2.12.4

References (2)

https://lists.apache.org/thread/8vv0311bvrrqxsyn913pcwf7pctyk52w · [email protected]http://www.openwall.com/lists/oss-security/2026/07/30/17 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

30 JUL 15:55Z
Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering
cvelistv5