Apache Shiro before 3.0.2 keeps deleted users after PropertiesRealm reload
Original title: CVE-2026-129348: Apache Shiro: PropertiesRealm reload does not remove deleted users or narrowed permissions
CVE-2026-129348 is rated CVSS 4.0 2.3 and applies only when PropertiesRealm loads properties from a file.
Lenny Primak reported that Apache Shiro PropertiesRealm can leave removed users and narrowed permissions in effect after reloading its properties file. The issue affects org.apache.shiro:shiro-core through 3.0.1 and is fixed in 3.0.2. CVSS 4.0 is 2.3 (low). The posted description is cut off after stating the condition.
Unconfirmed: The snippet is cut off before the full reload condition is stated.
- CVSS 4.0 score is 2.3 (low).
- Affected product is org.apache.shiro:shiro-core through 3.0.1.
- Fixed release named in the advisory is 3.0.2.
- The flaw applies only when PropertiesRealm loads properties from a file.
Impact: Removed users or narrowed permissions can remain in effect
| Product | Affected | Fixed in |
|---|---|---|
| Apache Shiro (shiro-core) | through 3.0.1 (before 3.0.2) | 3.0.2 |
- 1.Upgrade org.apache.shiro:shiro-core to 3.0.2.
- CVEs
- CVE-2026-129348
- Vendors
- Apache
- Products
- Apache Shiro
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-129348 | — | — | — |
From the original article
Posted by Lenny Primak on Nov 13 Severity: CVSS 4. 0: 2. 3 (low) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.