PT-2026-23516 · Unknown · Cloud Foundry Uaa+1

Published 2026-03-05 · Updated 2026-05-10 · CVE-2026-22723

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cloudfoundry UAA versions 77.30.0 through 78.7.0 Cloudfoundry Deployment versions 48.7.0 through 54.10.0

Description A logic error in the implementation of the token revocation endpoint leads to inappropriate user token revocation. The issue affects the token revocation process. The vulnerable component is the token revocation endpoint.

Recommendations Update Cloudfoundry UAA to a version later than 78.7.0. Update Cloudfoundry Deployment to a version later than 54.10.0.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

CWE-640

Related Identifiers

CVE-2026-22723

GHSA-6WCW-R64P-QRRW

Affected Products

Cloudfoundry Deployment

Cloud Foundry Uaa

References · 9

• https://cloudfoundry.org/blog/cve-2026-22723-uaa-user-token-revocation · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22723 · Security Note
• https://osv.dev/vulnerability/GHSA-6wcw-r64p-qrrw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22723 · Vendor Advisory
• https://github.com/cloudfoundry/uaa/releases/tag/v78.8.0 · Note
• https://github.com/cloudfoundry/uaa · Note
• https://github.com/cloudfoundry/uaa/commit/74c88235b5bc6e61752624700e91f61fd724dfcd · Note
• https://t.me/cveNotify/162942 · Telegram Post
• https://twitter.com/CVEnew/status/2030385208826986709 · Twitter Post