Executive brief
Spring Data REST is a framework used to automatically export database resources as web services. A vulnerability in its integration with the Querydsl filtering tool allows unauthorized users to access internal data fields that were intended to be hidden. This could lead to the exposure of sensitive information that should not be visible through the public web interface.
Technical details
An improper access control vulnerability exists in Spring Data REST's Querydsl integration. The component accepts arbitrary persistent property paths as request-parameter filter keys without validating them against Jackson customizations (such as @JsonIgnore). This allows a remote, unauthenticated attacker to bypass field-level security constraints and query internal entity properties via specially crafted request parameters. The vulnerability affects multiple versions of Spring Data REST and is resolved in versions 4.5.12, 5.0.6, and later.
Affected products
- VMware Spring Data REST core 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory