Junglewise Threat Intelligence

CVE-2026-41728: VMware Spring Data REST improper access control in JSON Patch

CVE-2026-41728 · Severity: high · CVSS 7.5 · Published 2026-06-10

Technologies: VMware Spring Data REST. Vendors: Spring, VMware.

Executive brief

Spring Data REST, a library used to build web services for data access, contains a security flaw in how it handles partial data updates (JSON Patch). An attacker can bypass security filters to modify data they should not have permission to change. This could lead to unauthorized data modification or corruption within the application's database.

Technical details

An improper access control vulnerability (CWE-284) exists in Spring Data REST's implementation of JSON Patch (application/json-patch+json). The root cause is that the implementation does not apply write-access filters to intermediate path segments when resolving a multi-segment JSON Pointer. A remote, unauthenticated attacker can exploit this over the network by sending a specially crafted JSON Patch request to modify restricted data fields. The vulnerability affects multiple versions across the 3.x, 4.x, and 5.x branches. Patches have been released in versions 4.5.12 and 5.0.6.

Affected products

  • Spring Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5

Timeline

  • 2026-06-09: patched: Versions 4.5.12 and 5.0.6 released
  • 2026-06-10: disclosed: Initial advisory publication
  • 2026-08-12: advisory: Advisory updated by GitHub and NVD

References

Related threats