Improper access control in Spring Data REST - CVE-2026-41837
Published: August 31, 2026
Vulnerability identifier: #VU146405
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41837
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in Spring Data REST Querydsl integration when processing request-parameter filter keys. A remote attacker can supply arbitrary persistent property paths as filter parameters to disclose sensitive information.
Jackson customizations are not considered before the property paths are handed to Querydsl, which can expose persistent fields that were intended to be hidden.
Affected software
Spring Data REST
How to mitigate CVE-2026-41837
Install security update from vendor's website.
Spring Data REST - addressed in versions 3.7.20, 4.3.17, 4.4.15, 4.5.11.1, 4.5.12, 5.0.5.1, 5.0.6