# CVE-2026-129348: Apache Shiro: PropertiesRealm reload does not remove deleted users or narrowed permissions

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/704) · 2026-11-14 · Security
Page: https://themorning.dev/story/cve-2026-129348-apache-shiro-propertiesrealm-reload-does-not-remove-deleted-user-f637d87f3d609d61
Kind: security · Impact: low

## In brief

- Apache Shiro's PropertiesRealm does not remove deleted users or narrowed permissions when it reloads.
- The flaw affects Apache Shiro (org.apache.shiro:shiro-core) before 3.0.2.
- The CVSS 4.0 base score is 2.3 (low), and the report was posted by Lenny Primak on November 13.

## Why it matters

Users removed from a PropertiesRealm config, or permissions revoked from them, can keep access after a reload, so access-control changes may not take effect.

## What to do

- Upgrade Apache Shiro to 3.0.2 or later.
- Check that users and permissions removed from PropertiesRealm config are no longer active after a reload.

## Versions

- Apache Shiro 3.0.2

## CVEs

- CVE-2026-129348

## Timeline

- 2026-11-13: Vulnerability disclosed on the oss-sec mailing list

## Coverage

- [CVE-2026-129348: Apache Shiro: PropertiesRealm reload does not remove deleted users or narrowed permissions](https://seclists.org/oss-sec/2026/q4/704) — Open Source Security, 2026-11-14

Tags: apache-shiro, java, authorization, authentication, vulnerability, cve

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev