CVE-2026-28812

EUVD-2026-51179
UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.
Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.89%
Affected Products (NVD)
VendorProductVersion
apachejspwiki
𝑥
< 2.12.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p
http://www.openwall.com/lists/oss-security/2026/07/30/15