diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7f69346..d952faf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Security
+
+* Update appbase to 4.0.3 to address CVE in transitive dependencies
+
 ## [5.0.0] - 2026-04-29
 
 ### Removed
diff --git a/pom.xml b/pom.xml
index 663e2a9..64e5f24 100644
--- a/pom.xml
+++ b/pom.xml
@@ -14,7 +14,7 @@
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
       <shiro.version>2.1.0</shiro.version>
-      <appbase.version>4.0.2</appbase.version>
+      <appbase.version>4.0.3</appbase.version>
       <logback.version>1.5.32</logback.version>
   </properties>
 
@@ -94,17 +94,6 @@
       <groupId>com.epimorphics</groupId>
       <artifactId>appbase</artifactId>
       <version>${appbase.version}</version>
-      <exclusions>
-        <exclusion>
-          <groupId>org.apache.commons</groupId>
-          <artifactId>commons-lang3</artifactId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.apache.commons</groupId>
-      <artifactId>commons-lang3</artifactId>
-      <version>3.20.0</version>
     </dependency>
 
     <dependency>