Junglewise Threat Intelligence

CVE-2026-54518: FasterXML jackson-databind authorization bypass in UnwrappedPropertyHandler

CVE-2026-54518 · Severity: medium · CVSS 6.5 · Published 2026-06-23

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Executive brief

FasterXML jackson-databind is a widely used Java library for converting data between JSON and Java objects. A flaw in how the library handles specific data-mapping instructions allows attackers to bypass security restrictions intended to limit which data fields can be modified. This could allow an unauthorized user to update sensitive internal fields, potentially leading to unauthorized data modification or privilege escalation within applications using the library.

Technical details

An authorization bypass vulnerability exists in jackson-databind's UnwrappedPropertyHandler.processUnwrappedCreatorProperties() method. When replaying buffered JSON into creator parameters, the library fails to consult the 'visibleInView' check for properties. Consequently, if a constructor parameter is annotated with both @JsonView and @JsonUnwrapped, an attacker can provide JSON input that populates these fields even when a more restrictive view is active. This allows for the modification of fields that were intended to be protected by the @JsonView write-side authorization boundary. The issue is fixed in versions 2.21.4 and 3.1.4.

Affected products

  • FasterXML jackson-databind >= 2.21.0, < 2.21.4
  • FasterXML jackson-databind >= 3.0.0, < 3.1.4

Timeline

  • 2026-05-07: patched: Fixes merged into 2.21 and 3.1 branches
  • 2026-06-16: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD

References

Related threats