The UserManager component in Apache JSPWiki does not perform sanity checks on the user database when the application starts, leading to an authentication failure (CWE‑290). An attacker who can insert or modify entries in the database before startup can cause the system to authenticate as another user, thereby gaining that user’s privileges. This flaw permits impersonation of any account, including administrative ones, elevating the attacker’s authority across the wiki.

Apache Software Foundation’s Apache JSPWiki versions up to and including 2.12.3 are affected. The vulnerability is resolved in version 2.12.4 and later, which implement proper validation of the user database at startup.

The CVSS score of 9.8 marks this as a critical vulnerability, while the EPSS score of <1% and absence from CISA’s KEV catalog suggest that public exploitation is currently limited. Nevertheless, the potential damage is high because the flaw allows an attacker to impersonate any user. Exploitation requires the ability to influence the user database content before the application loads, implying file‑system access or an insertion during startup. Due to the severity and the ability to grant administrative rights, urgent remediation is warranted.