Executive brief
A vulnerability in the Jackson-databind library, a popular tool for processing JSON data in Java applications, allows attackers to bypass security restrictions during data entry. Developers often use 'Views' to restrict which pieces of data a user can modify; however, when certain data structures are 'unwrapped,' these restrictions are ignored. This could allow an unauthorized user to perform 'mass-assignment' attacks, such as elevating their own account privileges or modifying sensitive fields they should not have access to.
Technical details
A vulnerability exists in Jackson-databind where UnwrappedPropertyHandler.processUnwrapped() fails to validate property visibility against the active view during deserialization. When a property is annotated with both @JsonView and @JsonUnwrapped, the library replays buffered JSON without checking the 'visibleInView' guard for the container property. This allows an attacker to provide JSON input for privileged fields that should be restricted by the active view. The issue affects both BeanDeserializer and BuilderBasedDeserializer. Patches are available in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Affected products
- FasterXML jackson-databind >= 2.18.0, <= 2.18.8
- FasterXML jackson-databind >= 2.21.0, < 2.21.5
- FasterXML jackson-databind >= 2.22.0, < 2.22.1
- tools.jackson.core:jackson-databind jackson-databind >= 3.0.0, <= 3.1.4
- tools.jackson.core:jackson-databind jackson-databind >= 3.2.0, < 3.2.1
Timeline
- 2026-07-10: patched: Fix published to FasterXML/jackson-databind
- 2026-07-14: advisory: NVD publication date
- 2026-07-21: disclosed: GitHub Advisory published