Vulnerability · low · CVSS 2.3
CVE-2026-129348: Apache Shiro PropertiesRealm reload keeps deleted users and permissions
Tier C · Keep an eye on it – Check if you’re affected
Who’s exposed: Apache Shiro deployments using PropertiesRealm with reloading
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
Popular tool
What to do
- Upgrade Apache Shiro to 3.0.2 or later.
- Check that users and permissions removed from PropertiesRealm config are no longer active after a reload.
The Brief
- Apache Shiro's PropertiesRealm does not remove deleted users or narrowed permissions when it reloads.
- The flaw affects Apache Shiro (org.apache.shiro:shiro-core) before 3.0.2.
- The CVSS 4.0 base score is 2.3 (low), and the report was posted by Lenny Primak on November 13.
Why it matters
Users removed from a PropertiesRealm config, or permissions revoked from them, can keep access after a reload, so access-control changes may not take effect.
The checklist behind the tier
Checklist · 2 of 10 yes
| Yes | Hits tech teams | Judgment: Apache Shiro is a Java auth/security framework that developers build with and ops run. |
| No | Core infrastructure | Judgment: a single Java security framework, not core infrastructure like OpenSSH or the Linux kernel. |
| Yes | Popular tool | Judgment: Apache Shiro is a widely used Java framework across many teams. |
| No | Exploited in the wild | Open Source Security post reports only a vulnerability disclosure; no observed attacks mentioned. |
| No | Public exploit | Open Source Security post describes the flaw with no published exploit code or PoC. |
| No | Remote, no login | Open Source Security post gives CVSS vector PR:L, so privileges are required. |
| No | Full takeover | Open Source Security post gives CVSS impact VC:L/VI:L/VA:N, not code execution or admin takeover. |
| No | Secrets exposed | Open Source Security post reports no stolen or exposed credentials or data. |
| No | Supply chain | Open Source Security post describes a reload logic bug in legitimate code, not malicious shipping. |
| No | No fix yet | Open Source Security post lists affected versions as before 3.0.2, implying a fixed release exists. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
- Exploited
- Not in CISA’s exploited catalog
Timeline
Vulnerability disclosed on the oss-sec mailing list
Open Source Security
CVE-2026-129348: Apache Shiro: PropertiesRealm reload does not remove deleted users or narrowed permissions
Source
CVE-2026-129348: Apache Shiro: PropertiesRealm reload does not remove deleted users or narrowed permissions ↗ Open Source Security · 2h ago
First seen · 1 source · Full story page · How tiers are decided