CVE-2026-28812

Critical · CVSS 9.8

CVSS: 9.8; nvd
EPSS: 0.31%; 24th pct
KEV: No
Class: other; CWE-290

Description

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.

References

https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p
http://www.openwall.com/lists/oss-security/2026/07/30/15

Status: profiled · ingested 2026-08-05T18:00:56.000Z