CVE-2026-28812

critical · 9.8

UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.

9.8

CVSS

0.4%

EPSS (exploit prob.)

34th

EPSS percentile

2026-07-30

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-290

Affected products

Vendor	Product	Affected versions
apache	jspwiki	< 2.12.4

Check a specific version with /api/v1/cve/match.

References

https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p
http://www.openwall.com/lists/oss-security/2026/07/30/15

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-28812