# CVE-2026-41728: VMware Spring Data REST improper access control in JSON Patch

Source: https://junglewise.ai/threats/cve-2026-41728-vmware-spring-data-rest-improper-access-control-in-json-patch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-41728 · Severity: high · CVSS 7.5 · Published 2026-06-10

Spring Data REST, a library used to build web services for data access, contains a security flaw in how it handles partial data updates (JSON Patch). An attacker can bypass security filters to modify data they should not have permission to change. This could lead to unauthorized data modification or corruption within the application's database.

Technologies: [org.springframework.data:spring-data-rest-core (Maven)](https://junglewise.ai/threats/technologies/org-springframework-data-spring-data-rest-core), [VMware Spring Data REST](https://junglewise.ai/threats/technologies/spring-data-rest). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Spring](https://junglewise.ai/threats/vendors/spring), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41728 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41728 being exploited in the wild.

**How severe is CVE-2026-41728?** High severity, with a CVSS score of 7.5, published 10 June 2026.

**Which products and versions are affected?** org.springframework.data:spring-data-rest-core (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.6; Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5; VMware Spring Data REST 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5.

**Is there a fix for CVE-2026-41728?** Yes. org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41728 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41728?** Check whether you run org.springframework.data:spring-data-rest-core (Maven), Spring Data REST or VMware Spring Data REST at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later

  ```sh
  # set org.springframework.data:spring-data-rest-core to 5.0.6 in your pom.xml or build.gradle
  ```


## Technical details

An improper access control vulnerability (CWE-284) exists in Spring Data REST's implementation of JSON Patch (application/json-patch+json). The root cause is that the implementation does not apply write-access filters to intermediate path segments when resolving a multi-segment JSON Pointer. A remote, unauthenticated attacker can exploit this over the network by sending a specially crafted JSON Patch request to modify restricted data fields. The vulnerability affects multiple versions across the 3.x, 4.x, and 5.x branches. Patches have been released in versions 4.5.12 and 5.0.6.

## Affected products

- Spring Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5

## Identifiers

- CVE-2026-41728
- GHSA-cv39-x4c6-hhp2

## Timeline

- 2026-06-09: patched: Versions 4.5.12 and 5.0.6 released
- 2026-06-10: disclosed: Initial advisory publication
- 2026-08-12: advisory: Advisory updated by GitHub and NVD

## References

- [https://spring.io/security/cve-2026-41728](https://spring.io/security/cve-2026-41728)
- [https://github.com/spring-projects/spring-data-rest/releases/tag/4.5.12](https://github.com/spring-projects/spring-data-rest/releases/tag/4.5.12)
- [https://github.com/spring-projects/spring-data-rest/releases/tag/5.0.6](https://github.com/spring-projects/spring-data-rest/releases/tag/5.0.6)

## Related threats

- [Spring Data REST identifier and version property mutation via JSON Patch](https://junglewise.ai/threats/cve-2026-47849-spring-data-rest-identifier-and-version-property-mutation-via)
- [Spring Data REST version property not preserved on immutable PUT](https://junglewise.ai/threats/cve-2026-47850-spring-data-rest-version-property-not-preserved-on-immutable-put)
- [VMware Spring Data REST improper access control in Querydsl integration](https://junglewise.ai/threats/cve-2026-41837-vmware-spring-data-rest-improper-access-control-in-querydsl)
- [VMware Spring Data REST information disclosure in exception serialization](https://junglewise.ai/threats/cve-2026-41730-vmware-spring-data-rest-information-disclosure-in-exception)
- [VMware Spring Data REST SpEL injection in JSON Patch processing](https://junglewise.ai/threats/cve-2026-41729-vmware-spring-data-rest-spel-injection-in-json-patch-processing)