CVE-2026-28813 in JSPWiki
Summary
by MITRE • 07/30/2026
Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes this issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
Apache JSPWiki versions up to 2.12.3 contain a critical security vulnerability classified as JSON Hijacking that exposes the application to Cross-Site Request Forgery attacks. This vulnerability stems from improper handling of JSON data structures within the web application's response processing mechanisms, creating an avenue for malicious actors to exploit the lack of proper origin validation and content type checking. The flaw allows attackers to manipulate JSON responses in a way that bypasses standard security controls designed to prevent unauthorized actions.
The technical implementation of this vulnerability occurs when the application processes JSON responses without adequate safeguards against prototype pollution or object manipulation attacks. This creates an environment where malicious scripts can intercept and alter JSON data flows between the client and server, effectively enabling attackers to execute unauthorized commands on behalf of authenticated users. The vulnerability operates at the application layer and specifically impacts how the wiki handles user session data and administrative functions through JSON-based APIs.
The operational impact of this vulnerability extends beyond simple data compromise, as it enables full exploitation of user sessions and potentially allows complete system takeover if administrative functions are accessible through the affected JSON endpoints. Attackers can leverage this weakness to perform actions such as creating new user accounts, modifying existing content, deleting pages, or accessing restricted administrative features without proper authentication. The vulnerability affects all users who have authenticated sessions within the JSPWiki environment, making it particularly dangerous for collaborative environments where multiple users interact with shared content management systems.
Security professionals should note that this vulnerability aligns with CWE-346 (Origin Validation Error) and represents a specific implementation of CSRF attacks through JSON response manipulation. The ATT&CK framework categorizes this under T1566 (Phishing) and T1071.004 (Application Layer Protocol: JSON) as it exploits weaknesses in how applications handle structured data responses. Organizations utilizing Apache JSPWiki should immediately implement the recommended upgrade to version 2.12.4, which includes proper JSON response validation mechanisms and enhanced CSRF protection measures. Additional mitigations should include implementing Content Security Policy headers, enabling proper CORS restrictions, and conducting comprehensive security testing of all JSON-based API endpoints to ensure no similar vulnerabilities exist in custom extensions or plugins.
The vulnerability demonstrates the critical importance of proper input validation and output encoding in web applications, particularly when handling structured data formats like JSON. Organizations should conduct thorough security assessments of their application frameworks and ensure that all components properly validate data integrity and maintain strict controls over how external data is processed and returned to users. Regular security updates and patch management processes become essential for maintaining operational security in collaborative environments where content management systems handle sensitive user data and administrative functions.