PT-2026-7017 · Apache · Apache Shiro

Jesse Yang + 1 · Publicado 2026-01-01 · Atualizado 2026-02-09 · CVE-2026-23903

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 2.0.7

Description An authentication bypass issue exists in Apache Shiro. The issue relates to bypassing authentication when accessing static files on case-insensitive filesystems by varying the case of the filename in the request, if only lower-case filters are present in Shiro. The issue only affects static files.

Recommendations Upgrade to version 2.0.7, which resolves the issue. Configure filterChainResolver.caseInsensitive = true in shiro.ini. Configure shiro.caseInsensitive=true in application.properties.

Correção

Enumeração de Fraquezas

CWE-289

Identificadores relacionados

CVE-2026-23903

GHSA-C244-P6M5-VQJ6

Produtos afetados

Apache Shiro

Referências · 19

• https://github.com/apache/shiro/commit/3b9638b957495004599aeaf24ba8949e309f26e8 · Nota
• https://github.com/apache/shiro · Nota
• https://ubuntu.com/security/CVE-2026-23903 · Aviso do Fabricante
• https://t.me/cveNotify/151389 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2020909659939299513 · Publicação no Twitter
• https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-23903 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23903 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-c244-p6m5-vqj6 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2026/02/08/1 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23903 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-23903 · Nota de Segurança
• https://twitter.com/CVEnew/status/2020796005785145786 · Publicação no Twitter
• https://t.me/cveNotify/151386 · Publicação no Telegram
• https://twitter.com/oss_security/status/2020541228866031724 · Publicação no Twitter