CVE-2026-22754: spring spring security Improper Access Control
Vulnerability summary
CVE-2026-22754 is a high (CVSS 7.5) Improper Access Control vulnerability in spring spring security. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 22-04-2026PublishedVulnerability first disclosed.
- 15-07-2026Last modifiedVulnerability information updated.
Description
Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
18%
Versus all other CVEs
30-day change
0.00 pp
From 0.27% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-551Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationIf a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Affected systems
Chainguard3 products
- apache-nifi< 2.9.0-r3
- apache-nifi-registry< 2.9.0-r5
- camunda-zeebe-8.9< 8.9.1-r1
Wolfi2 products
- apache-nifi< 2.9.0-r3
- apache-nifi-registry< 2.9.0-r5
Org.springframework.security1 product
- spring-security-config≥ 7.0.0, < 7.0.5
Spring1 product
- spring security≥ 7.0.0, ≤ 7.0.4
Vmware1 product
- spring_security≥ 7.0.0, < 7.0.5
5 vendors · 8 products
