Executive brief
LogNet's grpc-spring-boot-starter is a Spring Boot framework for building gRPC services (a modern remote procedure call system). A flaw in how the library processes security annotations silently weakens access controls: when a gRPC method has both class-level and method-level security rules, the library grants access if *either* rule permits it, rather than requiring the stricter rule. This allows authenticated low-privilege users to reach admin-only methods, enabling unauthorized data access or operations.
Technical details
The vulnerability is an improper authorization flaw (CWE-285) in the annotation processing component that merges class-level and method-level `@Secured` annotations. When both decorators are present, the library combines them into a single set and evaluates with `AffirmativeBased` logic (grant if any rule matches), causing a broad class-level rule to silently override a stricter method-level rule. For example, a method guarded by `@Secured("ROLE_ADMIN")` combined with a class-level `@Secured("ROLE_USER")` becomes accessible to `ROLE_USER` callers instead of requiring `ROLE_ADMIN`. The attack requires network access and a valid low-privilege account; exploitation depends on the target application using this stacked annotation pattern. No patch is currently available as of the report date.
Affected products
- LogNet grpc-spring-boot-starter up to 5.2.0
Timeline
- 2026-08-31: disclosed
- other: Project reported but has not responded