Executive brief
Apache JSPWiki, a popular wiki engine, contains a security flaw in how it manages user accounts. A lack of proper validation in the user management component allows an attacker to impersonate other users, potentially gaining administrative access to the wiki. This could lead to unauthorized modification of content or exposure of private wiki data. Organizations using JSPWiki should upgrade to version 2.12.4 to resolve this issue.
Technical details
A vulnerability exists in Apache JSPWiki's UserManager component due to insufficient sanity checks of the user database at startup. This flaw allows an attacker to perform user impersonation, which can lead to unauthorized privilege escalation within the application. The vulnerability affects all versions of Apache JSPWiki up to and including 2.12.3. The issue is resolved in version 2.12.4, which introduces the necessary validation checks. While the specific exploitation mechanism (e.g., database manipulation or session hijacking) is not detailed in the advisory, the root cause is identified as a failure to validate the integrity of the user store.
Affected products
- Apache Software Foundation JSPWiki up to 2.12.3
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory
- 2026-07-30: patched: Fixed in version 2.12.4