CVE-2026-129348: Apache Shiro: PropertiesRealm reload does not remove deleted users or narrowed permissions
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments that use Apache Shiro PropertiesRealm and rely on realm reloads to remove users or reduce permissions are affected. The issue concerns authorization state after a reload, rather than the initial properties-file configuration.
What access would an attacker need to benefit from this issue?
An attacker would need credentials or permissions that were removed or narrowed in the PropertiesRealm configuration. If the reload leaves the prior state in place, that user may retain access that administrators intended to revoke.
How can administrators check whether they are affected?
After deleting a user or reducing that user's permissions in the PropertiesRealm properties configuration, trigger the normal reload process and test the user's authentication and authorization. Continued access under the deleted account or prior permissions indicates the stale state remains active.