CVE-2026-129348: Apache Shiro: PropertiesRealm reload does not remove deleted users or narrowed permissions

The Brief

Apache Shiro's PropertiesRealm does not remove deleted users or narrowed permissions when it reloads.
The flaw affects Apache Shiro (org.apache.shiro:shiro-core) before 3.0.2.
The CVSS 4.0 base score is 2.3 (low), and the report was posted by Lenny Primak on November 13.

Why it matters

Users removed from a PropertiesRealm config, or permissions revoked from them, can keep access after a reload, so access-control changes may not take effect.

Who’s affected

Apache Shiro users of PropertiesRealm
Anyone running Apache Shiro before 3.0.2

What to do

Upgrade Apache Shiro to 3.0.2 or later.
Check that users and permissions removed from PropertiesRealm config are no longer active after a reload.

Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 2.3 (low) CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Green Affected versions: - Apache Shiro (org.apache.shiro:shiro-core) before 3.0.2 Description: When PropertiesRealm reloads its…

Read the full story at seclists.org ↗

Timeline

Nov 13
Vulnerability disclosed on the oss-sec mailing list
Nov 14 · 5:58 AM
Open Source Security
CVE-2026-129348: Apache Shiro: PropertiesRealm reload does not remove deleted users or narrowed permissions