by Kastro
Paper/Archive/CVE-2026-28812

CVE-2026-28812

Apache Software Foundation Apache JSPWiki — Apache JSPWiki: UserManager does not sanity-check user database at startup

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.8.528 × 2010.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.

Affected

ProductAffectedFixed inSource
Apache JSPWiki< 2.12.42.12.4CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2prefopenwall.com/lists/oss-security/2026/07/30/15