{"id":"CVE-2026-28812","aliases":["EUVD-2026-51179","GHSA-3qxc-7g4v-3gm9"],"status":"published","title":"Apache JSPWiki: UserManager does not sanity-check user database at startup","description":"UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0069,"percentile":0.53118,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-290"],"published":"2026-07-30T15:52:34Z","modified":"2026-10-28T02:31:12Z","products":[{"vendor":"apache","product":"jspwiki"},{"vendor":"apache software foundation","product":"apache jspwiki"}],"references":[{"url":"https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/30/15","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28812","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3qxc-7g4v-3gm9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28812.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-28812","title":"Apache JSPWiki: UserManager does not sanity-check user database at startup","description":"UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue.","status":"published","published":"2026-07-30T15:52:34.172Z","modified":"2026-07-31T15:28:08.984Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:20:01.969981Z"}],"euvd":[{"id":"EUVD-2026-51179","description":"UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue.","status":"published","published":"2026-07-30T15:52:34Z","modified":"2026-07-31T15:28:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:02:25.856077Z"}],"ghsa":[{"id":"GHSA-3qxc-7g4v-3gm9","title":"UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow...","description":"UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue.","status":"published","published":"2026-07-30T18:31:39Z","modified":"2026-07-31T18:32:12Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:10:00.305317Z"}],"nvd":[{"id":"CVE-2026-28812","description":"UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue.","status":"published","published":"2026-07-30T16:17:10.967Z","modified":"2026-10-23T22:10:00.16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:12:33.955581Z"}],"osv":[{"id":"CVE-2026-28812","title":"Apache JSPWiki: UserManager does not sanity-check user database at startup","description":"UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue.","status":"published","published":"2026-07-30T15:52:34.172Z","modified":"2026-10-28T02:31:12.476826138Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:00.530889Z"}]}}