Incorrect authorization in jackson-databind - CVE-2026-59889

Vulnerability identifier: #VU139151

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-59889

CWE-ID: CWE-863

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper access control in UnwrappedPropertyHandler.processUnwrapped() when deserializing @JsonUnwrapped container properties under a less-privileged active view. A remote user can supply crafted JSON values for a property annotated with both @JsonView and @JsonUnwrapped to escalate privileges.

This affects the write-side authorization behavior of @JsonView during deserialization, including merge and builder-based deserialization paths.

jackson-databind
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
Development Tools Module
Basesystem Module
Fedora
Db2 Developer Extension
Maximo Application Suite - IoT Component
CICS Transaction Gateway Desktop Edition
webMethods ControlPlane
webMethods developer portal
IBM Engineering Systems Design Rhapsody
Terracotta
PowerVC
IBM SPSS Collaboration and Deployment Services
IBM Common Licensing
Keycloak
jackson-dataformat-cbor
jackson-core
jackson-annotations
jackson-databind
jackson-modules-base
jackson-bom
EntireX

Install security update from vendor's website.

jackson-databind - addressed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, 3.2.1
Db2 Developer Extension - update to 1.2.0
IBM SPSS Collaboration and Deployment Services - addressed in versions 8.4.0.0 IF007, 8.5.0.0 IF007, 8.6.0.0 IF007, 9.0.0.0.0 IF009
IBM Common Licensing - update to 9.1
Maximo Application Suite - IoT Component - addressed in versions 9.0.22, 9.1.13, 9.2.1
webMethods ControlPlane - update to 11.1 Fix11
webMethods developer portal - update to 11.1 Fix16
Keycloak - update to 26.7.2
jackson-dataformat-cbor - update to 2.18.9-150200.3.24.1
jackson-core - update to 2.18.9-150200.3.25.1
jackson-annotations - update to 2.18.9-150200.3.25.1
jackson-databind - update to 2.18.9-150200.3.33.1
jackson-modules-base - update to 2.21.8-1.fc45
jackson-databind - update to 2.21.8-1.fc45
jackson-core - update to 2.21.8-1.fc45
jackson-bom - update to 2.21.8-1.fc45
IBM Engineering Systems Design Rhapsody - addressed in versions 10.0.0.6, 10.0.1.0.7, 10.0.2.0.5, 10.0.3.0.2
Terracotta - addressed in versions 10.15.0.38, 11.1.0.21, 12.1.0.3
EntireX - update to 12.1.0.0003-0779

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh

• Multiple vulnerabilities in jackson-databind
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition
• SUSE update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM EntireX
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in Keycloak
• Multiple vulnerabilities in Keycloak
• Multiple vulnerabilities in IBM Terracotta
• Multiple vulnerabilities in IBM Db2 Developer Extension
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in IBM webMethods Developer Portal and IBM webMethods ControlPlane
• IBM PowerVC update for jackson-databind
• IBM SPSS Collaboration and Deployment Services update for jackson-databind
• Fedora 45 update for jackson-bom, jackson-core, jackson-databind, jackson-modules-base