CVE-2026-47849

Overview

Spring Data REST builds on top of Spring Data repositories and exposes them automatically as hypermedia-driven REST resources. It inspects an application's repository interfaces and domain model at startup and then serves collection resources, item resources, search endpoints, and association links over HTTP, including the PUT, merge-patch, and RFC 6902 JSON Patch write operations, without any hand-written controller code.

An Authorization Bypass vulnerability (CVE-2026-47849) has been identified in the JSON Patch write path of Spring Data REST, which allows an authenticated client holding PATCH access to a resource to overwrite the identifier and version properties of the underlying aggregate. Overwriting the version property defeats optimistic locking and reintroduces lost updates, while overwriting the identifier property makes the following repository save write over a record that belongs to a different principal.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects the JSON Patch and merge-patch request handling of Spring Data REST, in applications that export a repository whose entity type declares an identifier or version property that is visible to Jackson's deserialization model, meaning the property has a public setter and is not excluded with @JsonIgnore.

‍

Details

Module Info

• Product: NES for Spring Data REST
• Affected packages: org.springframework.data:spring-data-rest-webmvc
• Affected versions: >=5.1.0 <5.1.1, >=5.0.0 <5.0.7, >=4.5.0 <=4.5.13, >=4.0.0 <=4.4.15, <=3.7.20
• GitHub repository: https://github.com/spring-projects/spring-data-rest
• Published packages: https://central.sonatype.com/artifact/org.springframework.data/spring-data-rest-webmvc
• Package manager: Maven
• Fixed in:
• NES for Spring Data REST 3.5.12-spring-data-rest-3.5.17, 3.7.18-spring-data-rest-3.7.28, 4.2.12-spring-data-rest-4.2.20, 4.3.13-spring-data-rest-4.3.18, 4.4.13-spring-data-rest-4.4.18, and 4.5.13-spring-data-rest-4.5.15
• OSS Spring Data REST 5.1.1 and 5.0.7

Vulnerability Info

This High-severity vulnerability is found in the org.springframework.data:spring-data-rest-webmvc package in the JSON Patch request handling of Spring Data REST.

When a request arrives with the application/json-patch+json content type, every JSON Pointer in the patch document is translated into a property reference before the operation is applied. Write operations resolve their pointer segments through the binding context, which asks the mapped Jackson property metadata whether the segment names a writable field:

// spring-data-rest-webmvc/src/main/java/org/springframework/data/rest/webmvc/json/JacksonBindContext.java
@Override
public Optional<String> getWritableProperty(String segment, Class<?> type) {

	return getProperty(entities.getPersistentEntity(type)
			.map(it -> MappedProperties.forDeserialization(it, mapper))
			.filter(it -> it.isWritableField(segment)), segment);
}

The writability decision itself considers only Jackson's ignored-property set and the plain writability of the mapped persistent property. It never asks whether the property is the aggregate's identifier or its version:

// spring-data-rest-webmvc/src/main/java/org/springframework/data/rest/webmvc/json/MappedProperties.java
public boolean isWritableField(String name) {

	Assert.hasText(name, "Property name must not be null or empty");

	if (ignoredPropertyNames.contains(name)) {
		return false;
	}

	PersistentProperty<?> property = fieldNameToProperty.get(name);

	return property != null ? property.isWritable() : anySetterFound;
}

Because an identifier or version property with a public setter is writable in Jackson's terms, a pointer such as /id or /version is accepted, mapped to the matching property path, and applied to the loaded aggregate. The PUT path is guarded separately: a merging property handler skips the identifier and version properties there, so a client-supplied value for either is discarded on that path. The merge-patch path carries no such guard. It resolves its field names through the same writability decision shown above, so a merge-patch body that names the identifier or version property is applied to the aggregate in the same way. An attacker who is already authorized to patch one item resource can therefore replace its version to erase concurrent-modification protection, or replace its identifier with the identifier of a record owned by another principal so that the ensuing save clobbers that record. The class holding this check is named MappedJacksonProperties in the newest lines and MappedProperties in the older ones.

The last public release of the 4.5 line, 4.5.13, still contains the unguarded check, so that line is affected through its latest publicly available build.

‍

Steps to Reproduce

1. Export a Spring Data REST repository for an entity whose identifier or version property has a public setter and is not annotated with @JsonIgnore.

2. Authenticate as a principal that is allowed to PATCH one item resource of that repository.

3. Send an RFC 6902 JSON Patch request whose pointer targets the version property:

PATCH /orders/42 HTTP/1.1
Content-Type: application/json-patch+json

[ { "op": "replace", "path": "/version", "value": 0 } ]

4. The request is accepted instead of being rejected as an invalid pointer, and the stored aggregate carries the supplied version, so a stale client write is no longer detected.

5. Repeat step 3 with a pointer of /id and the identifier of a record owned by a different principal. The patched aggregate is saved under that identifier and overwrites the other principal's record.

‍

Mitigation

Only recent versions of Spring Data REST receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Data REST.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• The published advisory for this issue does not credit an external finder.