Vulnerability in Spring Spring Security. If an application uses <sec:intercept-url servlet-path="/servlet-path" pattern="/endpoint/**"/> to define the servlet path for computing a path matcher, then the servlet path is not included and the related authorization rules are not exercised. This can lead to an authorization bypass.This issue affects Spring Security: from 7.0.0 through 7.0.4.
References
| Link | Resource |
|---|---|
| https://spring.io/security/cve-2026-22754 | Mitigation Vendor Advisory |
Configurations
History
24 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Vmware spring Security
Vmware |
|
| References | () https://spring.io/security/cve-2026-22754 - Mitigation, Vendor Advisory | |
| CPE | cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* |
22 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-284 |
22 Apr 2026, 06:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 06:16
Updated : 2026-04-24 14:16
NVD link : CVE-2026-22754
Mitre link : CVE-2026-22754
CVE.ORG link : CVE-2026-22754
JSON object : View
Products Affected
vmware
- spring_security
CWE
CWE-284
Improper Access Control