CVE-2026-22723: Cloudfoundry UAA has logic error in the token revocation endpoint implementation

CVE-2026-22723 · Severity: medium · CVSS 6.5 · Published 2026-03-05

CloudFoundry User Authentication and Authorization (UAA) is a service used to manage identity and access for cloud applications. A logic error in how the system handles session cancellations allows an authenticated user to inappropriately revoke tokens, potentially leading to a denial of service for other users. This could disrupt business operations by preventing legitimate users from accessing their cloud-based applications and services.

Technologies: Cloudfoundry Cf-Deployment, org.cloudfoundry.identity:cloudfoundry-identity-server (Maven). Vendors: Cloudfoundry, Maven.

Quick answers

Is CVE-2026-22723 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22723 being exploited in the wild.
How severe is CVE-2026-22723?
Medium severity, with a CVSS score of 6.5, published 5 March 2026.
Which products and versions are affected?
org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) ECOSYSTEM:introduced=77.30.0,fixed=78.8.0.
Is there a fix for CVE-2026-22723?
Yes. org.cloudfoundry.identity:cloudfoundry-identity-server (Maven): upgrade to 78.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22723 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22723?
Check whether you run Cloudfoundry Cf-Deployment, Cloudfoundry Uaa-Release or org.cloudfoundry.identity:cloudfoundry-identity-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.cloudfoundry.identity:cloudfoundry-identity-server (Maven): upgrade to 78.8.0 or later
    # set org.cloudfoundry.identity:cloudfoundry-identity-server to 78.8.0 in your pom.xml or build.gradle

Technical details

A logic error exists in the token revocation endpoint of CloudFoundry UAA. An authenticated attacker with network access can exploit this flaw to revoke user tokens that they should not have the authority to manage. This vulnerability is classified as a Protection Mechanism Failure (CWE-693) and results in a denial of service (DoS) for the affected user sessions. The issue is present in UAA Release versions v77.30.0 through v78.7.0 and CF Deployment versions v48.7.0 through v54.10.0. Patches are available in UAA Release v78.8.0 and CF Deployment v54.11.0.

Affected products

  • CloudFoundry UAA Release v77.30.0 to v78.7.0
  • CloudFoundry CF Deployment v48.7.0 to v54.10.0

Identifiers

  • CVE-2026-22723
  • GHSA-6wcw-r64p-qrrw

Timeline

  • 2026-02: other: Initial vulnerability report published internally
  • 2026-03-05: advisory: Public advisory released by CloudFoundry Foundation
  • 2026-03-05: patched: Fixes released in UAA v78.8.0 and CF Deployment v54.11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.