CVE-2026-94243

HighCVSS 7.3

Published: 23/09/2026(UTC)Updated: 06/10/2026(UTC)Translated: 23/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

2th percentile - higher than 2% of all known CVEs

Summary

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-origin evidence. This issue affects versions before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue.

Risk Assessment

Accepting weaker origin evidence may enable CSRF attacks or unauthorized requests, potentially leading to data integrity issues.

Recommendation

Upgrade Apache Sling Security Bundle to version 1.3.2 or later.

Other vulnerabilities in Apache Sling Security Bundle

CVE-2026-94251Medium
A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource. This issue affects versions before 1.3.12. Users are recommended to upgrade to version 1.3.12, which fixes the issue.

Original NVD description (English source)

A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS