Executive brief
java-json-tools json-patch is a Java library that implements JSON Patch operations for modifying JSON documents. A vulnerability in the copy and move operations allows attackers to read sensitive internal fields (such as password hashes or API keys) and copy them to user-visible locations, bypassing access controls and exfiltrating data that should remain hidden. This can lead to exposure of secrets stored within the same JSON document.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the CopyOperation.apply() and MoveOperation.apply() methods of src/main/java/com/github/fge/jsonpatch/CopyOperation.java. The root cause is that the 'from' path parameter is accepted directly from user input without any validation or access control check. An attacker with network access and the ability to submit JSON Patch operations (no authentication required to exploit the library itself, though API-level auth may exist) can read any field within the JSON document and write its value to any other location. The exploit is particularly effective when the API returns modified fields to the user, allowing exfiltration of sensitive internal data. Patches and updates have not yet been released by the project as of the report date.
Affected products
- java-json-tools json-patch up to 1.13
Timeline
- 2026-07-29: disclosed: Security issue #170 opened on GitHub
- 2026-09-08: advisory: CVE-2026-86512 published