Executive brief
Spring Data REST is a framework that simplifies building RESTful APIs for Spring applications. This vulnerability allows attackers to modify critical identifier and version properties of data objects through JSON Patch requests, potentially leading to unauthorized data manipulation, loss of data integrity, or application state corruption.
Technical details
Spring Data REST fails to properly validate and protect @Id and @Version annotated properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. These properties should be immutable as they are fundamental to data integrity and optimistic locking mechanisms. An authenticated attacker sending a specially crafted JSON Patch request can modify these protected properties, bypassing intended access controls. This allows mutation of identifiers and version fields that should remain under framework or database control, compromising data consistency and potentially enabling unauthorized object manipulation.
Affected products
- VMware Spring Data REST 3.7.20 and earlier, 4.0.0-4.4.15, 4.5.0-4.5.12, 5.0.0-5.0.6, 5.1.0
Timeline
- 2026-08-27: disclosed