CVE-2026-22754: ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules
Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22754?
CVE-2026-22754 is classified as a medium severity vulnerability.
How do I fix CVE-2026-22754?
To fix CVE-2026-22754, it is recommended to update Spring Security to version 7.0.5 or later.
What versions of Spring Security are affected by CVE-2026-22754?
CVE-2026-22754 affects Spring Security versions from 7.0.0 to 7.0.4.
What type of vulnerability is CVE-2026-22754?
CVE-2026-22754 is a path matching vulnerability that affects the XML authorization rules in Spring Security.
Can CVE-2026-22754 lead to unauthorized access?
Yes, CVE-2026-22754 could potentially allow unauthorized access due to improper path matching.