{"id":"CVE-2026-28812","state":"PUBLISHED","title":"Apache JSPWiki: UserManager does not sanity-check user database at startup","description":"UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue.","publishedAt":"2026-07-30T15:52:34.172Z","updatedAt":"2026-07-31T15:28:08.984Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache JSPWiki"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache JSPWiki","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.12.4","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p","http://www.openwall.com/lists/oss-security/2026/07/30/15"],"weaknesses":["CWE-290"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/28xxx/CVE-2026-28812.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-28812","state":"PUBLISHED","datePublished":"2026-07-30T15:52:34.172Z","dateUpdated":"2026-07-31T15:28:08.984Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-03-03T15:01:12.543Z"},"containers":{"cna":{"title":"Apache JSPWiki: UserManager does not sanity-check user database at startup","descriptions":[{"lang":"en","value":"UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache JSPWiki","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2.12.4","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p","tags":["vendor-advisory"]}],"metrics":[{"other":{"content":{"text":"moderate"},"type":"Textual description of severity"}}],"problemTypes":[{"descriptions":[{"description":"Use of impersonation","lang":"en"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-07-30T15:52:34.172Z"},"credits":[{"lang":"en","type":"finder","value":"Florian Holeczek from Apache JSPWiki"}],"source":{"defect":["JSPWIKI-130"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/07/30/15"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-07-30T16:36:31.861Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-31T15:28:05.878355Z","id":"CVE-2026-28812","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-290","type":"CWE","lang":"en","description":"CWE-290 Authentication Bypass by Spoofing"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-31T15:28:08.984Z"}}]}}}