CVE-2026-28814

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@apache.org

Published

2026-07-30

Last modified

2026-10-23

Weaknesses

CWE-306

Affected products

• Jspwiki (Apache)
• Apache Jspwiki (Apache Software Foundation)

References

• https://lists.apache.org/thread/8vv0311bvrrqxsyn913pcwf7pctyk52w
• http://www.openwall.com/lists/oss-security/2026/07/30/17