Vulnerability · medium · CVSS 6.3
Apache Shiro authorization annotations not always enforced (CVE-2026-74763)
Tier B · Patch this week – Put it in the sprint
Who’s exposed: Apps using Shiro Guice authorization annotations before 3.0.2
Tier B because: Core infrastructure or popular tool AND remote, no login
Reach
Attack
Damage
Fix
Popular tool · Remote, no login
What to do
- Upgrade org.apache.shiro:shiro-guice to 3.0.2 or later
The Brief
- CVE-2026-74763 affects Apache Shiro's shiro-guice module, where authorization annotations are not always enforced depending on where they are placed.
- The issue is rated CVSS 4.0 6.3 (medium) in the advisory.
- Affected versions are shiro-guice before 3.0.2.
Why it matters
Applications that rely on Shiro annotations for access control may expose protected methods without the intended authorization check, depending on how the annotations are placed.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Shiro is a Java security framework that developers build applications with. |
| No | Core infrastructure | Judgment: Shiro is a single framework, not software nearly every team runs. |
| Yes | Popular tool | Judgment: Shiro is a widely used mainstream Java framework across many teams. |
| No | Exploited in the wild | Open Source Security: advisory only, no reported attacks using this flaw. |
| No | Public exploit | Open Source Security: advisory only, no exploit code or PoC mentioned. |
| Yes | Remote, no login | Open Source Security: CVSS vector AV:N/PR:N/UI:N indicates network access without privileges or user interaction. |
| No | Full takeover | Open Source Security: CVSS impact VC:L/VI:L/VA:N, limited confidentiality and integrity; no code execution or admin takeover stated. |
| No | Secrets exposed | Open Source Security: no report of stolen credentials, keys, configs or data. |
| No | Supply chain | Open Source Security: a normal authorization bug in legitimate code, no compromised package or pipeline. |
| No | No fix yet | Open Source Security: affected versions listed as before 3.0.2, implying a fixed version exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on oss-sec by Lenny Primak
Open Source Security
CVE-2026-74763: Apache Shiro: Authorization annotations not always enforced, depending on where they are placed
Source
CVE-2026-74763: Apache Shiro: Authorization annotations not always enforced, depending on where they are placed ↗ Open Source Security · 54 min ago
First seen · 1 source · Full story page · How tiers are decided