diff --git a/CHANGELOG.md b/CHANGELOG.md
index bc6d2713ec..42f2061564 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 - Update resteasy to version 4.5.2.Final
+- Update shiro to version 1.5.2
 - Use browser built-in EventSource for apiClient subscriptions
 - Changeover to MIT license ([#1066](https://github.com/scm-manager/scm-manager/pull/1066))
 
diff --git a/pom.xml b/pom.xml
index c38bb5ef84..2054116a65 100644
--- a/pom.xml
+++ b/pom.xml
@@ -926,7 +926,7 @@
 
     <!-- security libraries -->
     <ssp.version>1.2.0</ssp.version>
-    <shiro.version>1.5.1</shiro.version>
+    <shiro.version>1.5.2</shiro.version>
 
     <!-- repository libraries -->
     <jgit.version>5.6.1.202002131546-r-scm1</jgit.version>