Vulnerability · Published Mar 5, 2026 · Assigned by vmware
CVE-2026-22723UAA User Token Revocation logic error
Medium 6.5
In plain English
A medium-severity security flaw in UAA from Cloudfoundry Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 82.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.cloudfoundry.identity:cloudfoundry-identity-server | 78.8.0 | GHSA-6wcw-r64p-qrrw |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cloudfoundry Foundation | UAA | 77.30.0 – through v78.7.0 |
Weakness: CWE-693, CWE-640 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H