# CVE-2026-74763: Apache Shiro: Authorization annotations not always enforced, depending on where they are placed

Source: [Open Source Security](https://seclists.org/oss-sec/2026/q4/701) · 2026-11-14 · Security
Page: https://themorning.dev/story/cve-2026-74763-apache-shiro-authorization-annotations-not-always-enforced-depend-98c7f48a3b3b6813
Kind: security · Impact: medium

## In brief

- CVE-2026-74763 affects Apache Shiro's shiro-guice module, where authorization annotations are not always enforced depending on where they are placed.
- The issue is rated CVSS 4.0 6.3 (medium) in the advisory.
- Affected versions are shiro-guice before 3.0.2.

## Why it matters

Applications that rely on Shiro annotations for access control may expose protected methods without the intended authorization check, depending on how the annotations are placed.

## What to do

- Upgrade org.apache.shiro:shiro-guice to 3.0.2 or later

## Versions

- shiro-guice 3.0.2

## CVEs

- CVE-2026-74763

## Timeline

- 2026-11-13: Vulnerability disclosed on oss-sec by Lenny Primak

## Coverage

- [CVE-2026-74763: Apache Shiro: Authorization annotations not always enforced, depending on where they are placed](https://seclists.org/oss-sec/2026/q4/701) — Open Source Security, 2026-11-14

Tags: apache-shiro, authorization, java, security, cve-2026-74763

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev