Dashboard / CVE-2026-22754

CVE-2026-22754

INFO Priority: 0.00 BB Relevance: 0/100
Published: 2026-04-22 Modified: 2026-10-26 First seen: 2026-10-29 Status: pending_score

Description

Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
vmware spring_security 7.0.0 – 7.0.5

References & Advisories (4)

https://spring.io/security/cve-2026-22754
Mitigation Vendor Advisory

Bug Bounty Relevance

0 / 100

CVSS Score

Unscored

EPSS — Exploitation Probability

0.27%
Raw Score 0.002660
Percentile 18.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00266
2026-10-28
0.00266

Intelligence Sources

nvd ref →

External Links