Junglewise Threat Intelligence

CVE-2026-22754: Spring Spring Security authorization bypass in intercept-url matching

CVE-2026-22754 · Severity: high · CVSS 7.5 · Published 2026-04-22

Technologies: VMware Spring Security. Vendors: VMware, Spring, Maven.

Executive brief

Spring Security is a widely used framework for securing Java-based web applications. A vulnerability exists where specific configuration rules for protecting web endpoints are ignored, potentially allowing unauthorized users to access restricted parts of an application. This could lead to unauthorized data modification or access to administrative functions that should be protected.

Technical details

An authorization bypass vulnerability exists in Spring Security versions 7.0.0 through 7.0.4. The flaw occurs when an application uses the '<sec:intercept-url>' tag with both a 'servlet-path' and a 'pattern' attribute to define security constraints. In these configurations, the framework fails to include the specified servlet path when computing the path matcher, resulting in the associated authorization rules not being exercised. An unauthenticated remote attacker can exploit this to bypass intended access controls. The issue is addressed in Spring Security 7.0.5.

Affected products

  • Spring Spring Security 7.0.0 to 7.0.4

Timeline

  • 2026-04-22: disclosed
  • 2026-04-22: advisory

References

Related threats