AIKIDO-2026-11169

spring-data-rest-core is vulnerable to Improper Access Control

Improper Access ControlCVE-2026-41837 Published Today

Medium Risk

This Affects:

spring-data-rest-core

0.0.1 - 3.7.19

Fixed in 3.7.20

4.0.0 - 4.3.16

Fixed in 4.3.17

4.4.0 - 4.4.14

Fixed in 4.4.15

4.5.0 - 4.5.11

Fixed in 4.5.12

5.0.0 - 5.0.5

Fixed in 5.0.6

Are you affected? Scan for Free

TL;DR

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

spring-data-rest-core is vulnerable to Improper Access Control in versions 0.0.1 - 3.7.19, 4.0.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11 and 5.0.0 - 5.0.5.

How to fix this

Upgrade the org.springframework.data:spring-data-rest-core library to the patch version. Until upgrading, applications can mitigate the issue by implementing QuerydslBinderCustomizer on each affected repository and calling bindings.excludeUnlistedProperties(true) together with an explicit allow-list of filterable property paths.