CVE-2026-74763: Apache Shiro: Authorization annotations not always enforced, depending on where they are placed

The Brief

CVE-2026-74763 affects Apache Shiro's shiro-guice module, where authorization annotations are not always enforced depending on where they are placed.
The issue is rated CVSS 4.0 6.3 (medium) in the advisory.
Affected versions are shiro-guice before 3.0.2.

Why it matters

Applications that rely on Shiro annotations for access control may expose protected methods without the intended authorization check, depending on how the annotations are placed.

Who’s affected

Teams using Apache Shiro shiro-guice before 3.0.2

What to do

Upgrade org.apache.shiro:shiro-guice to 3.0.2 or later

shiro-guice 3.0.2
CVE-2026-74763
#apache-shiro
#authorization
#java
#security
#cve-2026-74763

Posted by Lenny Primak on Nov 13 Severity: CVSS 4.0: 6.3 (medium) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/S:N/AU:N/V:D/RE:L/U:Amber Affected versions: - Apache Shiro (org.apache.shiro:shiro-guice) before 3.0.2 - Apache Shiro…

Read the full story at seclists.org ↗

Timeline

Nov 13
Vulnerability disclosed on oss-sec by Lenny Primak
Nov 14 · 4:53 AM
Open Source Security
CVE-2026-74763: Apache Shiro: Authorization annotations not always enforced, depending on where they are placed