CVE-2026-94243
Received Received - Intake

ReferrerFilter Weak Origin Validation in Apache Sling Security Bundle

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Apache Software Foundation

Description
A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-94243
EUVD
EUVD-2026-85182

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache sling_security_bundle to 1.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Apache Sling Security Bundle's ReferrerFilter accepting weaker evidence than the origin. This means it may not properly validate the source of requests, potentially allowing unauthorized or malicious referrals.

Impact Analysis

This vulnerability could allow attackers to bypass security controls by manipulating referrer information, leading to unauthorized access or data exposure. Users of affected versions should upgrade to version 1.3.2 or later to mitigate the risk.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability involves a weakness in the ReferrerFilter of Apache Sling Security Bundle, which could potentially allow unauthorized referrer-based access. However, no explicit compliance implications are mentioned in the context.

Mitigation Strategies

Upgrade Apache Sling Security Bundle to version 1.3.2 or later to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94243. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart