Improper access control in spring-boot - CVE-2026-40973

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU128232

Improper access control in spring-boot - CVE-2026-40973

Published: April 27, 2026


Vulnerability identifier: #VU128232
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40973
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to disclose sensitive information, hijack authenticated users, or execute arbitrary code.

The vulnerability exists due to improper access control in ApplicationTemp when using a predictable temporary directory for persistent session storage without ownership verification. A local user can take control of the directory used by ApplicationTemp to disclose sensitive information, hijack authenticated users, or execute arbitrary code.

Exploitation requires server.servlet.session.persistent to be set to true and the attack to persist across application restarts.


Affected software

spring-boot
Db2 Developer Extension
MongoDB Enterprise Advanced with IBM
Library Support for Spring
IBM Sterling Control Center
IBM InfoSphere Information Server

How to mitigate CVE-2026-40973

Install security update from vendor's website.

spring-boot - addressed in versions 2.7.33, 3.3.19, 3.4.16, 3.5.14, 4.0.6
Db2 Developer Extension - update to 1.1.2
Library Support for Spring - update to 3.4.18
IBM Sterling Control Center - addressed in versions 6.3.1.0.9, 6.4.1.0.3, 6.4.2.0.4
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3
MongoDB Enterprise Advanced with IBM - update to 1.16.0

External References

Related Security Bulletins