CVE-2026-28814 HIGH CVSS 7.5 apache_jspwiki Verified Advisory

Unauthenticated Wiki Markup rendering in Apache JSPWiki (CVE-2026-28814)

Authentication Bypass Apache Information Disclosure Jspwiki

Apache JSPWiki up to version 2.12.3 permits arbitrary Wiki Markup rendering due to a lack of authentication. An unauthenticated attacker can exploit this flaw to obtain sensitive data stored in JSPWiki variables. Affected versions: - Apache JSPWiki up to 2.12.3 We recommend updating to: 2.12.4. CVSS 7.5 · our assessment: this_week Reference: https://seclists.org/oss-sec/2026/q3/342 Details: https://vuln.today/cve/CVE-2026-28814

Verified by vuln.today against published advisories.

Affected versions

– Apache JSPWiki up to 2.12.3

Fixed in: 2.12.4

Full CVE analysis Reference Published Jul 30, 2026

More advisories for apache_jspwiki

CVE-2026-28813 – JSON hijacking in Apache JSPWiki (CVE-2026-28813)

← All verified advisories