{"id":"CVE-2026-28812","summary":"Apache JSPWiki: UserManager does not sanity-check user database at startup","details":"UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.\nUsers are recommended to upgrade to version 2.12.4 or newer which fixes this issue.","modified":"2026-10-24T10:31:05.382015162Z","published":"2026-07-30T15:52:34.172Z","database_specific":{"cna_assigner":"apache","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28812.json","unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"2.12.4"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/07/30/15"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28812.json"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/n3m666d6t6871dldvz3ct49ooqkbgw2p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28812"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/jspwiki","events":[{"introduced":"0"},{"last_affected":"e04dda38bc9eb06265f368acea3ae04d62834b93"}],"database_specific":{"extracted_events":[{"source":"DESCRIPTION","range":[{"introduced":"0"},{"last_affected":"2.12.3"}]}]}}],"versions":["2.12.3-RC2","2.12.3","2.12.3-RC1","2.12.2-RC1","2.12.2","2.12.1-RC1","2.12.1","2.12.0-RC2","2.12.0","2.12.0-RC1","2.11.3-RC1","2.11.3","2.11.2-RC1","2.11.2","2.11.1-RC1","2.11.1","2.11.0-RC2","2.11.0","2.11.0-RC1","2.11.0.M8-RC1","2.11.0.M8","2.11.0.M7-RC1","2.11.0.M7","2.11.0.M6-RC1","2.11.0.M6","2.11.0.M5-RC3","2.11.0.M5","2.11.0.M5-RC2","2.11.0.M5-RC1","2.11.0.M4-RC2","2.11.0.M4","2.11.0.M4-RC1","2.11.0.M3-RC2","2.11.0.M3","2.11.0.M3-RC1","2.11.0.M2-RC1","2.11.0.M2","2.11.0.M1.RC3","2.11.0.M1","2.11.0.M1-RC2","2.11.0.M1-RC1","2.10.5-RC2","2.10.5","2.10.5-RC1","2.10.4-RC3","2.10.4","2.10.4-RC2","2.10.4-RC1","2.10.3-RC2","2.10.3","2.10.3-RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28812.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}