Executive brief
Spring Security is a widely used framework for securing Java-based web applications. A vulnerability exists where specific configuration rules for protecting web endpoints are ignored, potentially allowing unauthorized users to access restricted parts of an application. This could lead to unauthorized data modification or access to administrative functions that should be protected.
Technical details
An authorization bypass vulnerability exists in Spring Security versions 7.0.0 through 7.0.4. The flaw occurs when an application uses the '<sec:intercept-url>' tag with both a 'servlet-path' and a 'pattern' attribute to define security constraints. In these configurations, the framework fails to include the specified servlet path when computing the path matcher, resulting in the associated authorization rules not being exercised. An unauthenticated remote attacker can exploit this to bypass intended access controls. The issue is addressed in Spring Security 7.0.5.
Affected products
- Spring Spring Security 7.0.0 to 7.0.4
Timeline
- 2026-04-22: disclosed
- 2026-04-22: advisory