Apache Shiro before 3.0.2 may skip authorization annotations (CVE-2026-74763)
Original title: CVE-2026-74763: Apache Shiro: Authorization annotations not always enforced, depending on where they are placed
Four integration modules are affected, with a medium CVSS 4.0 score of 6.3.
Lenny Primak reported that Apache Shiro does not always enforce authorization annotations, depending on where they are placed. Affected artifacts are shiro-guice and shiro-aspectj before 3.0.2, and shiro-cdi and shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2. The advisory rates the issue CVSS 4.0 6.3 (medium). The posted description is truncated.
Unconfirmed: The description is truncated, so the exact bypass conditions are not fully stated.
- CVSS 4.0 vector is published as 6.3 medium.
- shiro-guice and shiro-aspectj before 3.0.2 are listed.
- shiro-cdi and shiro-jakarta-ee from 2.0.0-alpha-0 before 3.0.2 are listed.
- The post was published on November 13.
Impact: Authorization annotations may not be enforced
| Product | Affected | Fixed in |
|---|---|---|
| Apache Shiro shiro-guice | before 3.0.2 | 3.0.2 |
| Apache Shiro shiro-aspectj | before 3.0.2 | 3.0.2 |
| Apache Shiro shiro-cdi | 2.0.0-alpha-0 before 3.0.2 | 3.0.2 |
| Apache Shiro shiro-jakarta-ee | 2.0.0-alpha-0 before 3.0.2 | 3.0.2 |
- 1.Upgrade affected Apache Shiro modules to 3.0.2.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-74763 | — | — | — |
From the original article
Posted by Lenny Primak on Nov 13 Severity: CVSS 4. 0: 6. 3 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.