CVE-2026-28812

—

CVSS 3.1

9.8 critical

EPSS

<1%p34

Published

Jul 30, 2026 (Jul 30, 2026)

Modified

Aug 5, 2026

Description

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.

Vendors: apache
Products: jspwiki
Weakness: CWE-290
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.