Is CVE-2026-28813 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28813 being exploited in the wild.

How severe is CVE-2026-28813?

Informational severity, with a CVSS score of 0, published 30 July 2026.

Which products and versions are affected?

Apache Software Foundation JSPWiki up to 2.12.3.

Is there a fix for CVE-2026-28813?

A patch was published on 2026-07-30: Version 2.12.4 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28813 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-28813?

Check whether you run Apache Software Foundation JSPWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28813: Apache JSPWiki JSON hijacking leading to CSRF

CVE-2026-28813 · Severity: info · CVSS 0 · Published 2026-07-30

Apache JSPWiki, a popular wiki engine, is vulnerable to a security flaw that could allow an attacker to trick a logged-in user into performing unintended actions. By exploiting how the system handles data in the background, an attacker could potentially modify wiki content or settings without the user's knowledge. Organizations using this software should upgrade to version 2.12.4 to protect their wiki data and user sessions.

Technologies: Apache Software Foundation JSPWiki. Vendors: Apache Software Foundation.

Quick answers

Is CVE-2026-28813 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28813 being exploited in the wild.
How severe is CVE-2026-28813?: Informational severity, with a CVSS score of 0, published 30 July 2026.
Which products and versions are affected?: Apache Software Foundation JSPWiki up to 2.12.3.
Is there a fix for CVE-2026-28813?: A patch was published on 2026-07-30: Version 2.12.4 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28813 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-28813?: Check whether you run Apache Software Foundation JSPWiki at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Apache JSPWiki versions up to 2.12.3 are vulnerable to JSON Hijacking, a specific form of Cross-Site Request Forgery (CSRF). The vulnerability arises when the application returns sensitive data in a JSON format that can be intercepted by a malicious third-party site if a user is authenticated. An attacker can leverage this to bypass CSRF protections or extract data from the wiki environment. The issue is addressed in version 2.12.4 by implementing stricter controls on JSON responses and request validation. No specific authentication level is required beyond the victim being logged into the vulnerable JSPWiki instance.

Affected products

Apache Software Foundation JSPWiki up to 2.12.3

Timeline

2026-07-30: disclosed: Initial disclosure by Apache Software Foundation
2026-07-30: patched: Version 2.12.4 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.