Improper access control in Spring Boot - CVE-2026-40973
Published: April 27, 2026
Vulnerability identifier: #VU128232
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-40973
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information, hijack authenticated users, or execute arbitrary code.
The vulnerability exists due to improper access control in ApplicationTemp when using a predictable temporary directory for persistent session storage without ownership verification. A local user can take control of the directory used by ApplicationTemp to disclose sensitive information, hijack authenticated users, or execute arbitrary code.
Exploitation requires server.servlet.session.persistent to be set to true and the attack to persist across application restarts.
Affected software
Spring Boot
Library Support for Spring
IBM Sterling Control Center
IBM InfoSphere Information Server
MongoDB Enterprise Advanced with IBM
Library Support for Spring
IBM Sterling Control Center
IBM InfoSphere Information Server
MongoDB Enterprise Advanced with IBM
How to mitigate CVE-2026-40973
Install security update from vendor's website.
Spring Boot - addressed in versions 2.7.33, 3.3.19, 3.4.16, 3.5.14, 4.0.6
Library Support for Spring - update to 3.4.18
IBM Sterling Control Center - addressed in versions 6.3.1.0.9, 6.4.1.0.3, 6.4.2.0.4
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3
MongoDB Enterprise Advanced with IBM - update to 1.16.0
Library Support for Spring - update to 3.4.18
IBM Sterling Control Center - addressed in versions 6.3.1.0.9, 6.4.1.0.3, 6.4.2.0.4
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3
MongoDB Enterprise Advanced with IBM - update to 1.16.0