What is CVE-2026-28814?

CVE-2026-28814 is a high-severity vulnerability in Apache Jspwiki, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2026-07-30.

How severe is CVE-2026-28814?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Apache Jspwiki

CVE-2026-28814

Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue.

Vulnerability class: Broken Authentication

EPSS: 0.004 (34.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Apache Jspwiki
Apache Software Foundation Jspwiki — versions 0

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2026-28814?: CVE-2026-28814 is a high-severity vulnerability in Apache Jspwiki, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2026-07-30.
How severe is CVE-2026-28814?: High severity. CVSS v3 base score is 7.5 out of 10.