Executive brief
Spring Data REST, a library used to build web services for data access, contains a security flaw in how it handles partial data updates (JSON Patch). An attacker can bypass security filters to modify data they should not have permission to change. This could lead to unauthorized data modification or corruption within the application's database.
Technical details
An improper access control vulnerability (CWE-284) exists in Spring Data REST's implementation of JSON Patch (application/json-patch+json). The root cause is that the implementation does not apply write-access filters to intermediate path segments when resolving a multi-segment JSON Pointer. A remote, unauthenticated attacker can exploit this over the network by sending a specially crafted JSON Patch request to modify restricted data fields. The vulnerability affects multiple versions across the 3.x, 4.x, and 5.x branches. Patches have been released in versions 4.5.12 and 5.0.6.
Affected products
- Spring Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5
Timeline
- 2026-06-09: patched: Versions 4.5.12 and 5.0.6 released
- 2026-06-10: disclosed: Initial advisory publication
- 2026-08-12: advisory: Advisory updated by GitHub and NVD