CVE-2026-22754

CVE-2026-22754 is an authorization bypass vulnerability in Spring Security versions 7.0.0 through 7.0.4 that occurs when applications use the sec:intercept-url servlet-path attribute to define path matchers. The vulnerability causes the servlet path to be excluded from authorization rule evaluation, allowing attackers to bypass intended access controls on protected endpoints. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction, making it remotely exploitable. While the attack complexity is low and the integrity impact is high, there is no impact to confidentiality or availability. The FAUCET Risk Score of 48.0 out of 100 reflects moderate concern within the security community. There is currently no evidence of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, and it is not listed on the Hot List, indicating limited public awareness and community attention. Organizations running affected Spring Security versions should prioritize patching to mitigate this authorization bypass risk.