SB20260828186 - Multiple vulnerabilities in Spring Data REST

Description

This security bulletin contains information about 2 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-47849)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to overwrite identifier or version properties and modify other users' records.

The vulnerability exists due to improper access control in the JSON Patch request handling code path when processing RFC 6902 JSON Patch requests. A remote user can send a specially crafted patch request to overwrite identifier or version properties and modify other users' records.

Applications are affected when the exposed repository entity declares an identifier or version property that is visible to Jackson deserialization, such as via a public setter and without explicit exclusion.

2) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-47850)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to overwrite concurrent updates.

The vulnerability exists due to improper preservation of the version property in HTTP PUT handling for immutable aggregate roots when processing PUT requests against immutable target types. A remote user can submit a crafted request body containing a version value to overwrite concurrent updates.

The issue affects immutable aggregate types such as Java records, Kotlin data classes, all-args @PersistenceCreator types, and cases involving a body-driven polymorphic subtype change. Applications are affected when the version property is visible to Jackson deserialization and is not excluded via @JsonIgnore.

Remediation

Install update from vendor's website.

References

• https://spring.io/security/cve-2026-47849
• https://spring.io/security/cve-2026-47850