AIKIDO-2026-11175

spring-data-rest-core is vulnerable to Improper Access Control

Improper Access ControlCVE-2026-41728 Published Today

High Risk

This Affects:

spring-data-rest-core

0.0.1 - 3.7.19

Fixed in 3.7.20

4.0.0 - 4.3.16

Fixed in 4.3.17

4.4.0 - 4.4.14

Fixed in 4.4.15

4.5.0 - 4.5.11

Fixed in 4.5.12

5.0.0 - 5.0.5

Fixed in 5.0.6

Are you affected? Scan for Free

TL;DR

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected applications are those whose domain model includes an embeddable object, collection, or map property whose container is marked read-only at the Jackson level while the inner element type carries no per-field restriction.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

spring-data-rest-core is vulnerable to Improper Access Control in versions 0.0.1 - 3.7.19, 4.0.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11 and 5.0.0 - 5.0.5.