CVE-2026-28812

CriticalCVSS 9.8

Published: 30/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Summary

Apache JSPWiki up to version 2.12.3 lacks checks in UserManager, allowing impersonation. An attacker can escalate privileges.

Risk Assessment

An attacker can gain unauthorized access to other users' accounts and escalate privileges, potentially leading to full system compromise.

Recommendation

It is recommended to upgrade Apache JSPWiki to version 2.12.4 or newer, which fixes the issue.

Original NVD description (English source)

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.