External risk intelligence

Apache JSPWiki UserManager Impersonation Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-28812

Apache JSPWiki is a web-based wiki application typically deployed as a public-facing or organization-wide internal web service. Because it functions as a web application intended for user collaboration and content access, it is commonly hosted on web servers accessible via the network, making the attack surface readily reachable in typical deployment scenarios.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical security vulnerability in Apache JSPWiki, a web-based wiki software, that could allow unauthorized individuals to gain elevated privileges. The issue stems from a lack of proper checks within the user management system, potentially enabling attackers to impersonate legitimate users.

An impersonation flaw exists in the wiki software.
Critical privilege escalation risk to consider.
Confirm relevance and review potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage the UserManager's insufficient validation within Apache JSPWiki to impersonate users. This could potentially allow them to escalate their privileges within the wiki system.

Requires network access to the vulnerable application.
Exploits a lack of checks in user management.
Risks unauthorized privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to impersonate other users, potentially leading to unauthorized access and modification of wiki content. The impact is dependent on how the wiki is configured and the sensitivity of the information it hosts.

Wiki data and user accounts at risk.
Unauthenticated network access possible.
Unauthorized content modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Apache JSPWiki affects the UserManager component, allowing for privilege escalation. The primary responsibility for addressing this typically falls to the application owner or the platform team managing the wiki instance. The first crucial step is to identify all deployed instances of the affected software, confirm their network exposure and business criticality, and then locate the accountable owner for each instance to plan remediation.

Application or platform teams should own the issue.
Verify all JSPWiki instances and their exposure.
Plan and execute upgrades during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache JSPWiki?

Apache JSPWiki is a Java-based web application that functions as a wiki. It is widely used by organizations to create collaborative knowledge bases, documentation portals, and internal content sites. Because it is designed to manage structured pages and user contributions, it relies on a built-in user management system to control who can view, edit, or administer the wiki's content.

What does CWE-290 mean for CVE-2026-28812?

CWE-290 refers to Authentication Bypass by Spoofing. In the context of CVE-2026-28812, this means the software's UserManager component fails to properly verify the identity of someone interacting with it. Because of this weakness, the system can be tricked into accepting a request as if it came from a legitimate, perhaps highly privileged, user, even when the person making the request has not provided valid credentials.

How can an attacker trigger this impersonation flaw?

An attacker triggers this by interacting with the UserManager component over the network. They do not need to provide a password or have an existing account. It is important to note that this is not a glitch caused by clicking a specific link or opening a file; rather, it is a structural failure in how the application processes login or identification requests. If the application is reachable, the lack of validation allows the attacker to present forged identity information.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal flags this as a relevant concern because Apache JSPWiki is typically deployed as a networked service. Whether your instance is strictly internet-facing or hosted on an internal corporate network, it remains reachable to anyone with access to that segment. If your wiki is accessible to a broad user base or placed in a network zone that attackers can reach, your environment matches the typical deployment scenario where this vulnerability is actionable.

What are the first steps to secure my environment?

Your first priority is to locate all instances of Apache JSPWiki running in your infrastructure, including those managed by different teams. Once you have an inventory, confirm which ones are running versions up to 2.12.3. The designated owner for each instance should then prioritize upgrading the software to version 2.12.4 or newer, as this release contains the necessary logic to enforce proper identity checks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.