Improper access control in Spring Security - CVE-2026-22754
Published: April 27, 2026
Vulnerability identifier: #VU128226
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22754
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization rules.
The vulnerability exists due to improper access control in XML intercept-url authorization rule handling when computing path matching for configured servlet paths. A remote attacker can send a specially crafted request to bypass authorization rules.
The issue occurs when a servlet path is specified with servlet-path in XML authorization rules, causing the related rules not to be exercised.
Affected software
Spring Security
Storage Defender Copy Data Management
Storage Defender Copy Data Management
How to mitigate CVE-2026-22754
Install security update from vendor's website.
Spring Security - update to 7.0.5
Storage Defender Copy Data Management - update to 2.3.1.0
Storage Defender Copy Data Management - update to 2.3.1.0