CVE-2025-41249

Overview

Spring Framework is a comprehensive Java framework for building enterprise-level applications. It provides a powerful, flexible programming model that simplifies the development of web applications by allowing you to use Java as your primary language while offering a variety of tools to manage application configuration, data access, and security.

‍

One of Spring Security’s features—method security, enabled via @EnableMethodSecurity—allows developers to use annotations on methods (e.g. @PreAuthorize, @RolesAllowed) to enforce authorization decisions. When using these features, a possible Privilege Abuse vulnerability (CVE-2025-41249) has been discovered in Spring Framework’s annotation detection mechanism. 

‍

This occurs when methods are declared in generic superclasses or generic interfaces with unbounded generics, Spring might fail to correctly resolve security annotations on those methods. This defect can lead to authorization annotations being ignored, potentially allowing unauthorized access if the application relies on them for security enforcement.

‍

A Privilege Abuse vulnerability occurs when a system grants a user elevated or sensitive privileges, and those privileges are misused either intentionally by a malicious actor or unintentionally due to flawed enforcement mechanisms. Instead of breaking past access controls, attackers exploit the privileges they already have—or that the system incorrectly grants them—to perform unauthorized actions. This typically happens when security annotations, policies, or enforcement layers fail to correctly apply restrictions, creating opportunities for abuse.

Privilege abuse is a serious security risk because it can result in:

• Excessive Access to Sensitive Data: Users may leverage unintended privileges to read or manipulate confidential information such as customer data, financial records, or intellectual property.
• Escalated Operations: Attackers can perform privileged actions that should normally be restricted, such as invoking administrative functions or executing protected business logic.
• Insider Threats: Authorized users may exploit their granted privileges beyond intended use, intentionally or unintentionally, leading to security breaches.
• System Integrity Risks: Abuse of misapplied privileges can enable unauthorized changes, manipulation of application state, or chaining into further compromises.

‍

This issue affects multiple versions of Spring Framework’s spring-core, spring-web and spring-messaging packages.

‍

Details

Module Info

• Product: Spring Framework
• Affected packages: spring-core, spring-web, spring-messaging
• Affected versions: >=5.3.0 <=5.3.44, >=6.0.0 <=6.0.29, >=6.1.0 <6.1.23, >=6.2.0 <6.2.11
• GitHub repository: https://github.com/spring-projects/spring-framework
• Published packages: https://central.sonatype.com/artifact/org.springframework/spring-beans
• Package manager: Maven
• Fixed In: NES for Spring Framework v5.3.48, v6.1.24

‍

Vulnerability Info

The security flaw applies when Spring Security’s method security is used (e.g. annotations used via @EnableMethodSecurity). This CVE is also related with the Spring Security CVE-2025-41248.

‍

The annotation detection logic does not always detect method-level security annotations when the method is defined in a superclass or interface whose type is parameterized with unbounded generics. Because of this, Spring may assume there is no annotation and skip the authorization check.

‍

An application is vulnerable if the following conditions are true:

• Your application uses Spring Security’s @EnableMethodSecurity
• You define security annotations (e.g. @PreAuthorize, @Secured) on methods declared in a superclass or interface that is generic and whose type parameters are unbounded (i.e. without explicit type bounds).

‍

Example

interface GenericControllerInterface<A, B> {

  @PreAuthorize
  void test(A value1, B value2);

}

abstract static class GenericControllerAbstractSuperclass<C> implements GenericControllerInterface<Long, C> {

  @Override
  public void test(Long value1, C value2) {
    // implementation
  }

}

static class GenericControllerImpl extends GenericControllerAbstractSuperclass<String> {
}

‍

Mitigation

Only recent versions of Spring Framework are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to supported versions of Spring Framework

• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credit

• Avgustin Marinov

‍