JSON hijacking in Apache JSPWiki (CVE-2026-28813)

Apache JSPWiki is vulnerable to JSON hijacking, a technique that exposes JSON responses to unauthorized cross-origin reads. This vulnerability leads to CSRF vulnerabilities, potentially allowing attackers to perform unauthorized actions on behalf of authenticated users. Affected versions: - Apache JSPWiki up to 2.12.3 We recommend updating to: 2.12.4. CVSS 8.8 · our assessment: this_week Reference: https://seclists.org/oss-sec/2026/q3/341 Details: https://vuln.today/cve/CVE-2026-28813