PT-2026-7017 · Apache · Apache Shiro

Jesse Yang + 1 · Published 2026-01-01 · Updated 2026-02-09 · CVE-2026-23903

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 2.0.7

Description An authentication bypass issue exists in Apache Shiro. The issue relates to bypassing authentication when accessing static files on case-insensitive filesystems by varying the case of the filename in the request, if only lower-case filters are present in Shiro. The issue only affects static files.

Recommendations Upgrade to version 2.0.7, which resolves the issue. Configure filterChainResolver.caseInsensitive = true in shiro.ini. Configure shiro.caseInsensitive=true in application.properties.

Fix

Weakness Enumeration

CWE-289

Related Identifiers

CVE-2026-23903

GHSA-C244-P6M5-VQJ6

Affected Products

Apache Shiro

References · 19

• https://ubuntu.com/security/CVE-2026-23903 · Vendor Advisory
• https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23903 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23903 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c244-p6m5-vqj6 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23903 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23903 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23903 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23903 · Vendor Advisory
• https://github.com/apache/shiro/commit/3b9638b957495004599aeaf24ba8949e309f26e8 · Note
• https://github.com/apache/shiro · Note
• https://t.me/cveNotify/151389 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2020909659939299513 · Twitter Post
• https://openwall.com/lists/oss-security/2026/02/08/1 · Note
• https://twitter.com/CVEnew/status/2020796005785145786 · Twitter Post