CVE-2026-47849
Received Received - Intake

JSON Patch Vulnerability in Spring Data REST

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
Spring Data REST does not guard identifier (@Id) and version (@Version) properties against mutation via RFC 6902 JSON Patch (application/json-patch+json) requests. Spring Data REST 5.1.0 Spring Data REST 5.0.0 - 5.0.6 Spring Data REST 4.5.0 - 4.5.12 Spring Data REST 4.0.0 - 4.4.15 Spring Data REST 3.7.20 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-47849
EUVD
EUVD-2026-66837

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
spring_project spring_data_rest to 3.7.21 (exc)
spring_project spring_data_rest From 4.0.0 (inc) to 4.4.15 (inc)
spring_project spring_data_rest From 4.5.0 (inc) to 4.5.12 (inc)
spring_project spring_data_rest From 5.0.0 (inc) to 5.1.0 (inc)
spring_project spring_data_rest 5.1.0
spring_project spring_data_rest 3.7.21
spring_project spring_data_rest 4.4.16
spring_project spring_data_rest 4.5.13
spring_project spring_data_rest 5.0.7
spring_project spring_data_rest 5.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Spring Data REST allows authenticated users with PATCH access to modify entity identifier and version properties via JSON Patch requests. This bypasses security checks, potentially disabling optimistic-locking protection or enabling unauthorized data overwrites by different users.

Detection Guidance

Detect this vulnerability by checking if your Spring Data REST version is affected. Use commands like 'curl -s http://your-server/actuator/info' or check Maven/Gradle dependencies for versions 3.7.20 or earlier, 4.0.0-4.4.15, 4.5.0-4.5.12, or 5.0.0-5.1.0.

Impact Analysis

An attacker could exploit this to change critical entity properties, leading to data corruption, unauthorized modifications, or bypassing security controls like version tracking. This requires authenticated access but could allow privilege escalation or data integrity violations.

Compliance Impact

This vulnerability could lead to unauthorized data modifications, violating integrity requirements in GDPR and HIPAA. It may also compromise audit trails if version properties are altered, undermining compliance with data protection and record-keeping regulations.

Mitigation Strategies

Upgrade to fixed versions: 3.7.21, 4.4.16, 4.5.13, 5.0.7, or 5.1.1. No additional mitigation is required after upgrading. Ensure no public setters for @Id or @Version properties exist or are excluded from Jackson deserialization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47849. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart