GitHub Advisoryadvisory · Maven

GHSA-4vrc-j85c-598c Spring Security Doesn't Correctly Include Servlet Path in Path Matching of XML Authorization Rules

HIGH Published 2026-04-22 Modified 2026-04-29 Official page ↗
Aliases
CVE-2026-22754
Ecosystem
Maven
Packages
org.springframework.security:spring-security-config
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284
Reviewed
2026-04-29

Affected packages

• Maven org.springframework.security:spring-security-config: >= 7.0.0, < 7.0.5 → fixed in 7.0.5

Description

Vulnerability in Spring Spring Security. If an application uses  to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass. This issue affects Spring Security: from 7.0.0 through 7.0.4.

Related

Alias · CVE (1)

  • CVE-2026-22754 Vulnerability in Spring Spring Security. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References