# CVE-2026-47849: Spring Data REST identifier and version property mutation via JSON Patch

Source: https://junglewise.ai/threats/cve-2026-47849-spring-data-rest-identifier-and-version-property-mutation-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-47849 · Severity: high · CVSS 7.1 · Published 2026-08-27

Spring Data REST is a framework that simplifies building RESTful APIs for Spring applications. This vulnerability allows attackers to modify critical identifier and version properties of data objects through JSON Patch requests, potentially leading to unauthorized data manipulation, loss of data integrity, or application state corruption.

Technologies: [VMware Spring Data REST](https://junglewise.ai/threats/technologies/spring-data-rest). Vendors: [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-47849 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47849 being exploited in the wild.

**How severe is CVE-2026-47849?** High severity, with a CVSS score of 7.1, published 27 August 2026.

**Which products and versions are affected?** VMware Spring Data REST 3.7.20 and earlier, 4.0.0-4.4.15, 4.5.0-4.5.12, 5.0.0-5.0.6, 5.1.0.

**Is there a fix for CVE-2026-47849?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47849 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-47849?** Check whether you run VMware Spring Data REST at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Spring Data REST fails to properly validate and protect @Id and @Version annotated properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. These properties should be immutable as they are fundamental to data integrity and optimistic locking mechanisms. An authenticated attacker sending a specially crafted JSON Patch request can modify these protected properties, bypassing intended access controls. This allows mutation of identifiers and version fields that should remain under framework or database control, compromising data consistency and potentially enabling unauthorized object manipulation.

## Affected products

- VMware Spring Data REST 3.7.20 and earlier, 4.0.0-4.4.15, 4.5.0-4.5.12, 5.0.0-5.0.6, 5.1.0

## Timeline

- 2026-08-27: disclosed

## References

- [https://spring.io/security/cve-2026-47849](https://spring.io/security/cve-2026-47849)

## Related threats

- [Spring Data REST version property not preserved on immutable PUT](https://junglewise.ai/threats/cve-2026-47850-spring-data-rest-version-property-not-preserved-on-immutable-put)
- [VMware Spring Data REST improper access control in Querydsl integration](https://junglewise.ai/threats/cve-2026-41837-vmware-spring-data-rest-improper-access-control-in-querydsl)
- [VMware Spring Data REST information disclosure in exception serialization](https://junglewise.ai/threats/cve-2026-41730-vmware-spring-data-rest-information-disclosure-in-exception)
- [VMware Spring Data REST SpEL injection in JSON Patch processing](https://junglewise.ai/threats/cve-2026-41729-vmware-spring-data-rest-spel-injection-in-json-patch-processing)
- [VMware Spring Data REST improper access control in JSON Patch](https://junglewise.ai/threats/cve-2026-41728-vmware-spring-data-rest-improper-access-control-in-json-patch)