Is CVE-2026-23903 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-23903 being exploited in the wild.

How severe is CVE-2026-23903?

Medium severity, with a CVSS score of 5.3, published 9 February 2026.

Which products and versions are affected?

Apache Shiro before 2.0.7; org.apache.shiro:shiro-spring (Maven) ECOSYSTEM:introduced=0,fixed=2.1.0.

Is there a fix for CVE-2026-23903?

Yes. org.apache.shiro:shiro-spring (Maven): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-23903 attacked?

It is attacked over the network.

Am I affected by CVE-2026-23903?

Check whether you run Apache Shiro or org.apache.shiro:shiro-spring (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-23903: Apache Shiro authentication bypass via case-sensitive filename matching

CVE-2026-23903 · Severity: medium · CVSS 5.3 · Published 2026-02-09

Apache Shiro is a widely-used authentication and authorization framework for Java applications. On case-insensitive filesystems (such as macOS), an attacker can bypass Shiro's static file access controls by varying the case of requested filenames, potentially accessing restricted resources that should be blocked by security filters.

Technologies: Apache Shiro, org.apache.shiro:shiro-spring (Maven). Vendors: Apache, Maven.

Quick answers

Is CVE-2026-23903 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-23903 being exploited in the wild.
How severe is CVE-2026-23903?: Medium severity, with a CVSS score of 5.3, published 9 February 2026.
Which products and versions are affected?: Apache Shiro before 2.0.7; org.apache.shiro:shiro-spring (Maven) ECOSYSTEM:introduced=0,fixed=2.1.0.
Is there a fix for CVE-2026-23903?: Yes. org.apache.shiro:shiro-spring (Maven): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23903 attacked?: It is attacked over the network.
Am I affected by CVE-2026-23903?: Check whether you run Apache Shiro or org.apache.shiro:shiro-spring (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.apache.shiro:shiro-spring (Maven): upgrade to 2.1.0 or later

# set org.apache.shiro:shiro-spring to 2.1.0 in your pom.xml or build.gradle

Technical details

This is a path traversal / access control bypass vulnerability affecting Apache Shiro's static file serving. The root cause is that Shiro's filter chain comparison is case-sensitive (typically configured with lowercase patterns), but when static files are served from case-insensitive filesystems, an attacker can request the same file using alternate casing (e.g., /Admin/Config.txt instead of /admin/config.txt) to circumvent lowercase-only filter rules. No authentication is required; the attack is a simple HTTP request with case variation. An attacker gains unauthorized access to protected static files. Patches are available: Shiro 2.0.7 and later, with case-insensitive filter support added in 2.1.0 and made default from 3.0.0 onward.

Affected products

Apache Shiro before 2.0.7

Identifiers

CVE-2026-23903
GHSA-c244-p6m5-vqj6

Timeline

2026-02-09: disclosed: CVE-2026-23903 published
2026-02-09: patched: Fixed in Shiro 2.0.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.