Riskcovery

CVE-2026-22754

ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules

State
Published
Severity
7.5 High
Published
Apr 22, 2026
Updated
Jul 15, 2026
Reserved
Jan 9, 2026

Read the record on cve.org

Description

Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nvmware
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nredhat-SADP

Weaknesses

  • CWE-284 Improper Access Control
  • CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Affected Products

ProductVersions
Spring SecuritySpring
  • 7.0.0 through 7.0.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.