CVE-2026-22723 PUBLISHED

UAA User Token Revocation logic error

Assigner: vmware
Reserved: 09.01.2026 Published: 05.03.2026 Updated: 06.03.2026

Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Cloudfoundry Foundation
Product	UAA
Versions	Default: unaffected affected from 77.30.0 to v78.7.0 (incl.)

References

https://www.cloudfoundry.org/blog/cve-2026-22723-uaa-user-token-revocation/