What is the CVSS score of CVE-2026-28812?

CVE-2026-28812 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Apache JSPWiki are affected by CVE-2026-28812?

Apache JSPWiki installations running version 2.12.3 or earlier are vulnerable to user impersonation attacks that could allow threat actors unauthorized access to sensitive business information and…. A patch is available.

How to fix or mitigate CVE-2026-28812?

Within 24 hours, identify all systems running Apache JSPWiki and determine which are running version 2.12.3 or earlier to assess exposure. Within 7 days, deploy vendor patch version 2.12.4 to all affected instances in a controlled manner, prioritizing production environments. Within 30 days, complete patching of all JSPWiki installations, validate patches in a staging environment beforehand, and review historical access logs for evidence of unauthorized user impersonation or privilege escalation prior to patching.

Apache JSPWiki CVE-2026-28812

EUVD-2026-51179 CRITICAL

Authentication Bypass by Spoofing (CWE-290)

2026-07-30

GHSA-3qxc-7g4v-3gm9

Authentication Bypass Apache Jspwiki

9.8

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable UserManager flaw exploitable without auth, privileges, or interaction (AV:N/AC:L/PR:N/UI:N); impersonating an admin yields full read/write/disruption, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 31, 2026 - 16:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 31, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jul 31, 2026 - 16:22 NVD

9.8 (CRITICAL)

Patch available

Jul 30, 2026 - 17:03 EUVD

Analysis Generated

Jul 30, 2026 - 14:19 vuln.today

CVE Published

Jul 30, 2026 - 13:48 oss-security

HIGH

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Privilege escalation via user impersonation affects Apache JSPWiki through version 2.12.3, where the UserManager component fails to properly validate identity checks, letting attackers assume other users' identities and elevate their privileges. The flaw is classified as an authentication bypass (CWE-290) and carries a CVSS 9.8, though its EPSS score is low (0.16%, 6th percentile) and no public exploit has been identified at time of analysis. A vendor patch is available in version 2.12.4.

Technical ContextAI

Apache JSPWiki is a Java/JSP-based open-source wiki engine built on the Java Servlet API and widely used for collaborative documentation and intranet knowledge bases. The root cause is CWE-290 (Authentication Bypass by Spoofing): the UserManager, which is responsible for resolving and binding a request to an authenticated principal, lacks sufficient checks to confirm that the asserted identity legitimately belongs to the requesting session. Because identity assertion is trusted without adequate verification, an attacker can spoof or impersonate another principal - including higher-privileged accounts - thereby bypassing the wiki's authorization model that governs page editing, administrative functions, and access controls.

RemediationAI

Vendor-released patch: upgrade to Apache JSPWiki 2.12.4 or newer, which the project states fixes the UserManager impersonation flaw - this is the primary and recommended action. Consult the vendor advisory at https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2026-28812 and the announcement thread at https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p before upgrading. If immediate upgrade is not possible, reduce exposure by restricting network reachability of the JSPWiki instance to trusted internal networks or VPN-only access, and placing it behind an authenticating reverse proxy so requests are gated before reaching the vulnerable UserManager logic (trade-off: this blocks legitimate anonymous/public wiki access and adds an auth layer to maintain). Additionally, tighten wiki authorization policies and audit accounts/ACLs for signs of privilege abuse, and monitor authentication and admin-action logs for unexpected identity changes until the patch is applied. No workaround fully substitutes for the 2.12.4 upgrade.