CVE-2026-22723: 
Java vulnerability analysis and mitigation

CVE-2026-22723 is a logic error vulnerability in the token revocation endpoint of Cloudfoundry UAA (User Account and Authentication) that allows inappropriate revocation of user tokens. It affects Cloudfoundry UAA versions 77.30.0 through 78.7.0 and Cloudfoundry Deployment (cf-deployment) versions 48.7.0 through 54.10.0. The vulnerability was published on March 5, 2026, with a patch released shortly after. It carries a CVSS v3.1 base score of 6.5 (Medium) (CloudFoundry Advisory, Red Hat CVE).

The root cause is a logic error (CWE-693: Protection Mechanism Failure; CWE-640: Weak Password Recovery Mechanism for Forgotten Password) in the token revocation endpoint implementation of Cloudfoundry UAA. A low-privileged, authenticated attacker can send crafted network requests to the token revocation endpoint, causing it to inappropriately revoke tokens belonging to other users rather than only the attacker's own tokens. No user interaction is required, and the attack is conducted entirely over the network (CloudFoundry Advisory, Feedly).

Successful exploitation allows an authenticated attacker with low privileges to revoke authentication tokens of arbitrary users, effectively locking legitimate users out of Cloudfoundry services — a denial-of-service impact. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS availability impact: High). In environments where Cloudfoundry UAA is central to authentication, widespread token revocation could disrupt access to all dependent services and applications (CloudFoundry Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires a valid (low-privileged) account on the affected Cloudfoundry instance, limiting opportunistic exploitation. The EPSS score is approximately 0.04%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

CloudFoundry has released patches addressing this vulnerability. Users should upgrade Cloudfoundry UAA to version 78.8.0 or later, and Cloudfoundry Deployment (cf-deployment) to version 54.11.0 or later. No specific configuration-based workaround has been published; upgrading to the fixed versions is the recommended remediation (CloudFoundry Advisory).