A flaw in the JSON plugin’s serialization mechanism allows a request that is being processed concurrently with another to observe and read data that belongs to the other session. The shared state is tied to the JSON interceptor’s SMD/JSON‑RPC handling, meaning that an attacker can gain unintended access to sensitive information from other users’ sessions. This vulnerability is classified as CWE‑567, which describes the inadvertent exposure of implementation data to an unintended audience.

The affected release is Apache Struts 7.2.1, developed and maintained by the Apache Software Foundation. Applications that explicitly enable the JSON interceptor or use the JSON result type are potentially impacted, while the default configuration of Struts does not activate the vulnerable code path.

An EPSS score of <1% and a CVSS score of 4.3 indicate a moderate severity but a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. If the JSON interceptor is enabled, an attacker can craft concurrent requests that trigger the shared serialization state and extract cross‑session data. This exposure compromises confidentiality and warrants mitigative action.